<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width">
<meta name="theme-color" content="#222"><meta name="generator" content="Hexo 6.1.0">


  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">



<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css">
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.1.1/animate.min.css">
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/jquery.fancybox.min.css">
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/pace/1.2.4/themes/green/pace-theme-minimal.css">
  <script src="https://cdnjs.cloudflare.com/ajax/libs/pace/1.2.4/pace.min.js" integrity="sha256-gqd7YTjg/BtfqWSwsJOvndl0Bxc8gFImLEkXQT8+qj0=" crossorigin="anonymous"></script>

<script class="next-config" data-name="main" type="application/json">{"hostname":"liukairui.me","root":"/","images":"/images","scheme":"Muse","darkmode":false,"version":"8.10.1","exturl":false,"sidebar":{"position":"left","display":"hide","padding":18,"offset":12},"copycode":true,"bookmark":{"enable":false,"color":"#222","save":"auto"},"mediumzoom":false,"lazyload":true,"pangu":true,"comments":{"style":"tabs","active":"valine","storage":true,"lazyload":false,"nav":null,"activeClass":"valine"},"stickytabs":false,"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"fadeInDown","post_body":"fadeInDown","coll_header":"fadeInLeft","sidebar":"fadeInUp"}},"prism":false,"i18n":{"placeholder":"搜索...","empty":"没有找到任何搜索结果：${query}","hits_time":"找到 ${hits} 个搜索结果（用时 ${time} 毫秒）","hits":"找到 ${hits} 个搜索结果"},"path":"/search.xml","localsearch":{"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false}}</script><script src="/js/config.js"></script>

    <meta name="description" content="尚硅谷Linux运维网络服务部分, 由刘川老师讲解, 介绍了常见网络服务DNCP,DNS,FTP,SAMBA...与LAMP,ANMP平台搭建, 数据库平台搭建,主讲:尚硅谷沈超与刘川,视频来自B站:BV164411J761">
<meta property="og:type" content="article">
<meta property="og:title" content="Linux网络服务与数据库笔记">
<meta property="og:url" content="http://liukairui.me/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/">
<meta property="og:site_name" content="LiuKairui Website">
<meta property="og:description" content="尚硅谷Linux运维网络服务部分, 由刘川老师讲解, 介绍了常见网络服务DNCP,DNS,FTP,SAMBA...与LAMP,ANMP平台搭建, 数据库平台搭建,主讲:尚硅谷沈超与刘川,视频来自B站:BV164411J761">
<meta property="og:locale" content="zh_CN">
<meta property="article:published_time" content="2021-04-07T16:00:01.000Z">
<meta property="article:modified_time" content="2021-10-18T06:44:13.574Z">
<meta property="article:author" content="Liu Kairui">
<meta property="article:tag" content="运维">
<meta property="article:tag" content="Linux">
<meta name="twitter:card" content="summary">


<link rel="canonical" href="http://liukairui.me/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/">



<script class="next-config" data-name="page" type="application/json">{"sidebar":"","isHome":false,"isPost":true,"lang":"zh-CN","comments":true,"permalink":"http://liukairui.me/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/","path":"article/Linux网络服务与数据库笔记/","title":"Linux网络服务与数据库笔记"}</script>

<script class="next-config" data-name="calendar" type="application/json">""</script>
<title>Linux网络服务与数据库笔记 | LiuKairui Website</title>
  

  <script src="/js/third-party/analytics/baidu-analytics.js"></script>
  <script async src="https://hm.baidu.com/hm.js?ea07bceb8f5fa721da2ebf01833faa32"></script>



<div class="nindexBK">
<div class="nindexBKC"></div>
<div class="nindex">
  <h1>Hey👋</h1>
  <p style="font-weight: 500; font-size: 2.2em">欢迎访问Liu Kairui的个人站.</p>
  <p>
      我是一个来自重庆的在校大学生, 偏爱于前端技术<!--与OS设计-->, 偶尔使用 JS / Go 进行轻量项目开发, 欢迎访问我的
      <a href="https://github.com/KairuiLiu" target="_blank"><i class="fab fa-github-alt"></i> GitHub</a> .
  </p>
  <p>
      这个网站主要用来存储学习 / 瞎搞的笔记, 同时提供了邮件、图床等服务. 对于一些自认为有趣的<a href="javascript:;" id="myProj">项目</a>, 我也会将项目介绍, 文档, 甚至是设计指南发布在这里.
  </p>
  <ul>
    <li><p><a href="/artrank/" target="_blank">ArtRank</a>: 基于Node.JS的PageRank文献管理推荐系统</p></li>
    <li><p><a href="/gooj/" target="_blank">GoOJ</a>: 基于Golang的高校在线评测系统</p></li>
    <li><p><a href="/projects/" target="_blank">更多 <i class="fas fa-angle-right"></i></a></p></li>

  </ul>
  <p>
      可以在这些平台找到我: 
      <a href="https://www.zhihu.com/people/liu-kai-rui-18" target="_blank">知乎</a>,
      <a href="https://space.bilibili.com/33238144" target="_blank">bilibili</a>
      和
      <a href="https://www.coolapk.com/u/805314?from=qr" target="_blank">酷安</a>.
  </p>

  <p>
      下滑即可进入博客 <i class="fas fa-arrow-down"></i>
  </p>
</div>
</div>  

 
<script>
  var OriginTitile = document.title;
  var titleTime;
  document.addEventListener("visibilitychange", function() {
    if (document.hidden) {
      document.title = "谢谢离开 | " + OriginTitile;
      clearTimeout(titleTime);
    } else {
      document.title = "欢迎归来 | " + OriginTitile;
      titleTime = setTimeout(function() {
        document.title = OriginTitile;
      }, 2000);
    }
  });
</script>


<script>
  function checkIndex(){
    let nindexItems = [[".nindexBK","display","block","none"],[".headband","display","none","block"],["div.toggle.sidebar-toggle","visibility","hidden","visible"]]; // ,["button.darkmode-toggle","visibility","hidden","visible"]];
    let isIndex = new RegExp("^(\/){0,1}(index){0,1}(\.html){0,1}(/)*$").test(location.pathname);
    let backCanvas = document.querySelector(".nindexBK");
    nindexItems.dispShift = function (stat){this.forEach((e) => {try{document.querySelector(e[0]).style[e[1]]=e[2+stat];}catch{}})}
    if(isIndex){
      nindexItems.dispShift(0);
      window.onscroll=function(){
        if(document.documentElement.scrollTop>backCanvas.offsetHeight*1.05){
          nindexItems.dispShift(1);window.onscroll=null;
        }
      }
      document.querySelector("#myProj").onclick=()=>{
        let projlist = document.querySelector(".nindex>ul");
        projlist.className.indexOf("ulactive")==-1?projlist.classList.add("ulactive"):projlist.classList.remove("ulactive")
      }
    }else nindexItems.dispShift(1);
  }
  checkIndex();
</script>

<!--<script src="https://sdk.jinrishici.com/v2/browser/jinrishici.js" charset="utf-8"></script>-->

  <noscript>
    <link rel="stylesheet" href="/css/noscript.css">
  </noscript>
<link rel="alternate" href="/atom.xml" title="LiuKairui Website" type="application/atom+xml">
<style>.darkmode--activated{--body-bg-color:#282828;--content-bg-color:#333;--card-bg-color:#555;--text-color:#ccc;--blockquote-color:#bbb;--link-color:#ccc;--link-hover-color:#eee;--brand-color:#ddd;--brand-hover-color:#ddd;--table-row-odd-bg-color:#282828;--table-row-hover-bg-color:#363636;--menu-item-bg-color:#555;--btn-default-bg:#222;--btn-default-color:#ccc;--btn-default-border-color:#555;--btn-default-hover-bg:#666;--btn-default-hover-color:#ccc;--btn-default-hover-border-color:#666;--highlight-background:#282b2e;--highlight-foreground:#a9b7c6;--highlight-gutter-background:#34393d;--highlight-gutter-foreground:#9ca9b6}.darkmode--activated img{opacity:.75}.darkmode--activated img:hover{opacity:.9}.darkmode--activated code{color:#69dbdc;background:0 0}button.darkmode-toggle{z-index:9999}.darkmode-ignore,img{display:flex!important}</style></head>

<body itemscope itemtype="http://schema.org/WebPage" class="use-motion">
  <div class="headband"></div>

  <main class="main">
    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏" role="button">
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <i class="logo-line"></i>
      <p class="site-title">LiuKairui Website</p>
      <i class="logo-line"></i>
    </a>
      <p class="site-subtitle" itemprop="description">要有信仰</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>



<nav class="site-nav">
  <ul class="main-menu menu">
        <li class="menu-item menu-item-home"><a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a></li>
        <li class="menu-item menu-item-categories"><a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类</a></li>
        <li class="menu-item menu-item-tags"><a href="/tags/" rel="section"><i class="fas fa-hashtag fa-fw"></i>标签</a></li>
        <li class="menu-item menu-item-收藏夹"><a href="/favorites/" rel="section"><i class="fab fa-gratipay fa-fw"></i>收藏夹</a></li>
        <li class="menu-item menu-item-留言板"><a href="/messageBoard/" rel="section"><i class="fab fa-facebook-messenger fa-fw"></i>留言板</a></li>
        <li class="menu-item menu-item-项目"><a href="/projects/" rel="section"><i class="fa fa-satellite fa-fw"></i>项目</a></li>
        <li class="menu-item menu-item-图床"><a href="http://img.liukairui.me/" rel="noopener" target="_blank"><i class="fa fa-bed fa-fw"></i>图床</a></li>
        <li class="menu-item menu-item-云ide"><a href="http://vsc.liukairui.me/" rel="noopener" target="_blank"><i class="fas fa-code fa-fw"></i>云IDE</a></li>
        <li class="menu-item menu-item-about"><a href="/about/" rel="section"><i class="fa fa-user fa-fw"></i>关于</a></li>
        <li class="menu-item menu-item-邮箱"><a href="http://mail.liukairui.me/mail" rel="noopener" target="_blank"><i class="fas fa-envelope-open-text fa-fw"></i>邮箱</a></li>
        <li class="menu-item menu-item-rss"><a href="/atom.xml" rel="section"><i class="fa fa-rss fa-fw"></i>RSS</a></li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup"><div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off" maxlength="80"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close" role="button">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div class="search-result-container no-result">
  <div class="search-result-icon">
    <i class="fa fa-spinner fa-pulse fa-5x"></i>
  </div>
</div>

    </div>
  </div>

</div>
        
  
  <div class="toggle sidebar-toggle" role="button">
    <span class="toggle-line"></span>
    <span class="toggle-line"></span>
    <span class="toggle-line"></span>
  </div>

  <aside class="sidebar">

    <div class="sidebar-inner sidebar-nav-active sidebar-toc-active">
      <ul class="sidebar-nav">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <div class="sidebar-panel-container">
        <!--noindex-->
        <div class="post-toc-wrap sidebar-panel">
            <div class="post-toc animated"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80%E6%9C%8D%E5%8A%A1"><span class="nav-number">1.</span> <span class="nav-text">网络基础服务</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#centos6%E4%B8%8Ecentos7%E5%8C%BA%E5%88%AB"><span class="nav-number">1.1.</span> <span class="nav-text">CentOS6与CentOS7区别</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%B8%B8%E8%A7%81%E7%9A%84%E7%BD%91%E7%BB%9C%E5%8D%8F%E8%AE%AE%E4%B8%8E%E7%AB%AF%E5%8F%A3"><span class="nav-number">1.2.</span> <span class="nav-text">常见的网络协议与端口</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%BD%91%E5%85%B3%E5%92%8C%E8%B7%AF%E7%94%B1"><span class="nav-number">1.3.</span> <span class="nav-text">网关和路由</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%BD%91%E7%BB%9C%E7%AE%A1%E7%90%86%E5%91%BD%E4%BB%A4"><span class="nav-number">1.4.</span> <span class="nav-text">网络管理命令</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#ssh%E7%AE%A1%E7%90%86"><span class="nav-number">1.5.</span> <span class="nav-text">SSH管理</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#tcp-wrappers-%E7%AE%80%E5%8D%95%E9%98%B2%E7%81%AB%E5%A2%99"><span class="nav-number">1.6.</span> <span class="nav-text">TCP Wrappers 简单防火墙</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#dhcp%E6%9C%8D%E5%8A%A1"><span class="nav-number">2.</span> <span class="nav-text">DHCP服务</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#dhcp%E7%9A%84%E5%B7%A5%E4%BD%9C%E5%8E%9F%E7%90%86"><span class="nav-number">2.1.</span> <span class="nav-text">DHCP的工作原理</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#dhcp%E6%9C%8D%E5%8A%A1%E6%90%AD%E5%BB%BA"><span class="nav-number">2.2.</span> <span class="nav-text">DHCP服务搭建</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#dns%E6%9C%8D%E5%8A%A1"><span class="nav-number">3.</span> <span class="nav-text">DNS服务</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%9F%9F%E5%90%8D%E7%9A%84%E7%BB%84%E6%88%90%E4%B8%8E%E5%88%86%E7%B1%BB"><span class="nav-number">3.1.</span> <span class="nav-text">域名的组成与分类</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%9F%9F%E5%90%8D%E8%A7%A3%E6%9E%90%E8%BF%87%E7%A8%8B"><span class="nav-number">3.2.</span> <span class="nav-text">域名解析过程</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#dns%E5%AE%9E%E9%AA%8C"><span class="nav-number">3.3.</span> <span class="nav-text">DNS实验</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#vsftp%E6%9C%8D%E5%8A%A1"><span class="nav-number">4.</span> <span class="nav-text">VSFTP服务</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#vsftp%E6%9C%8D%E5%8A%A1%E6%A6%82%E8%BF%B0"><span class="nav-number">4.1.</span> <span class="nav-text">VSFTP服务概述</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%99%BB%E5%BD%95%E9%AA%8C%E8%AF%81%E6%96%B9%E5%BC%8F"><span class="nav-number">4.2.</span> <span class="nav-text">登录验证方式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E4%BD%BF%E7%94%A8ftp"><span class="nav-number">4.3.</span> <span class="nav-text">使用FTP</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%99%AE%E9%80%9A%E5%AE%9E%E9%AA%8C"><span class="nav-number">4.4.</span> <span class="nav-text">普通实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#opensslvsftp%E5%8A%A0%E5%AF%86%E9%AA%8C%E8%AF%81"><span class="nav-number">4.5.</span> <span class="nav-text">openSSL+vsftp加密验证</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#samba%E6%9C%8D%E5%8A%A1"><span class="nav-number">5.</span> <span class="nav-text">SAMBA服务</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#samba%E6%A6%82%E8%BF%B0"><span class="nav-number">5.1.</span> <span class="nav-text">Samba概述</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%99%BB%E5%BD%95%E9%AA%8C%E8%AF%81%E6%A8%A1%E5%BC%8F"><span class="nav-number">5.2.</span> <span class="nav-text">登录验证模式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%9F%BA%E6%9C%AC%E4%BD%BF%E7%94%A8"><span class="nav-number">5.3.</span> <span class="nav-text">基本使用</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%9E%E9%AA%8C"><span class="nav-number">5.4.</span> <span class="nav-text">实验</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#nfs%E6%9C%8D%E5%8A%A1"><span class="nav-number">6.</span> <span class="nav-text">NFS服务</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#nfs%E6%8C%82%E8%BD%BD%E5%8E%9F%E7%90%86"><span class="nav-number">6.1.</span> <span class="nav-text">NFS挂载原理</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%9E%E9%AA%8C-1"><span class="nav-number">6.2.</span> <span class="nav-text">实验</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#lamp%E5%B9%B3%E5%8F%B0"><span class="nav-number">7.</span> <span class="nav-text">LAMP平台</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA"><span class="nav-number">7.1.</span> <span class="nav-text">环境搭建</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#apache"><span class="nav-number">8.</span> <span class="nav-text">Apache</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%90%AF%E5%8A%A8%E6%96%B9%E5%BC%8F"><span class="nav-number">8.1.</span> <span class="nav-text">启动方式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%B7%A5%E4%BD%9C%E6%A8%A1%E5%BC%8F"><span class="nav-number">8.2.</span> <span class="nav-text">工作模式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%96%87%E4%BB%B6%E4%BD%8D%E7%BD%AE"><span class="nav-number">8.3.</span> <span class="nav-text">文件位置</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6"><span class="nav-number">8.4.</span> <span class="nav-text">配置文件</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apache%E7%9B%AE%E5%BD%95%E5%88%AB%E5%90%8D%E5%AE%9E%E9%AA%8C"><span class="nav-number">8.5.</span> <span class="nav-text">Apache目录别名实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apache%E7%94%A8%E6%88%B7%E9%AA%8C%E8%AF%81"><span class="nav-number">8.6.</span> <span class="nav-text">Apache用户验证</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E8%99%9A%E6%8B%9F%E4%B8%BB%E6%9C%BA%E5%AE%9E%E9%AA%8C"><span class="nav-number">8.7.</span> <span class="nav-text">虚拟主机实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%9F%9F%E5%90%8D%E8%B7%B3%E8%BD%AC%E5%AE%9E%E9%AA%8C"><span class="nav-number">8.8.</span> <span class="nav-text">域名跳转实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apacheopenssl%E5%AE%9E%E9%AA%8Chttps"><span class="nav-number">8.9.</span> <span class="nav-text">Apache+OpenSSL实验https</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apache%E6%97%A5%E5%BF%97%E5%88%87%E5%89%B2"><span class="nav-number">8.10.</span> <span class="nav-text">Apache日志切割</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apache%E4%B8%8D%E8%AE%B0%E5%BD%95%E6%9F%90%E7%B1%BB%E5%9E%8B%E6%96%87%E4%BB%B6"><span class="nav-number">8.11.</span> <span class="nav-text">Apache不记录某类型文件</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apache%E9%9D%99%E6%80%81%E7%BC%93%E5%AD%98"><span class="nav-number">8.12.</span> <span class="nav-text">Apache静态缓存</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#apache%E7%A6%81%E6%AD%A2%E8%A7%A3%E6%9E%90php"><span class="nav-number">8.13.</span> <span class="nav-text">Apache禁止解析PHP</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#lnmp%E5%B9%B3%E5%8F%B0"><span class="nav-number">9.</span> <span class="nav-text">LNMP平台</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#nginx"><span class="nav-number">10.</span> <span class="nav-text">Nginx</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%A6%82%E5%BF%B5"><span class="nav-number">10.1.</span> <span class="nav-text">概念</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%B7%A5%E4%BD%9C%E6%A8%A1%E5%BC%8F-1"><span class="nav-number">10.2.</span> <span class="nav-text">工作模式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84"><span class="nav-number">10.3.</span> <span class="nav-text">配置文件结构</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%8A%B6%E6%80%81%E7%BB%9F%E8%AE%A1%E5%AE%9E%E9%AA%8C"><span class="nav-number">10.4.</span> <span class="nav-text">状态统计实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%9B%AE%E5%BD%95%E4%BF%9D%E6%8A%A4%E5%AE%9E%E9%AA%8C"><span class="nav-number">10.5.</span> <span class="nav-text">目录保护实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#ip%E9%AA%8C%E8%AF%81%E9%99%90%E5%88%B6"><span class="nav-number">10.6.</span> <span class="nav-text">IP验证限制</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E8%99%9A%E6%8B%9F%E4%B8%BB%E6%9C%BA%E5%AE%9E%E9%AA%8C-1"><span class="nav-number">10.7.</span> <span class="nav-text">虚拟主机实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%8F%8D%E5%90%91%E4%BB%A3%E7%90%86%E5%AE%9E%E9%AA%8C"><span class="nav-number">10.8.</span> <span class="nav-text">反向代理实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1"><span class="nav-number">10.9.</span> <span class="nav-text">负载均衡</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#https%E6%B0%B8%E4%B9%85%E9%87%8D%E5%86%99"><span class="nav-number">10.10.</span> <span class="nav-text">https+永久重写</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E9%82%AE%E4%BB%B6%E6%9C%8D%E5%8A%A1%E5%99%A8"><span class="nav-number">11.</span> <span class="nav-text">邮件服务器</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%A6%82%E8%BF%B0"><span class="nav-number">11.1.</span> <span class="nav-text">概述</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%90%AD%E5%BB%BAdns"><span class="nav-number">11.2.</span> <span class="nav-text">搭建DNS</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E9%85%8D%E7%BD%AE%E9%82%AE%E4%BB%B6%E5%8F%91%E9%80%81%E6%96%B9"><span class="nav-number">11.3.</span> <span class="nav-text">配置邮件发送方</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E9%85%8D%E7%BD%AE%E6%8E%A5%E6%94%B6%E6%96%B9"><span class="nav-number">11.4.</span> <span class="nav-text">配置接收方</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#web%E5%AE%A2%E6%88%B7%E7%AB%AF"><span class="nav-number">11.5.</span> <span class="nav-text">Web客户端</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#rsync"><span class="nav-number">12.</span> <span class="nav-text">Rsync</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#ssh%E5%8D%95%E6%AC%A1%E5%A4%87%E4%BB%BD%E5%AE%9E%E9%AA%8C"><span class="nav-number">12.1.</span> <span class="nav-text">SSH单次备份实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#rsync%E5%8D%95%E6%AC%A1%E5%A4%87%E4%BB%BD%E5%AE%9E%E9%AA%8C"><span class="nav-number">12.2.</span> <span class="nav-text">Rsync单次备份实验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#rsyncinotify%E5%AE%9E%E6%97%B6%E5%90%8C%E6%AD%A5"><span class="nav-number">12.3.</span> <span class="nav-text">Rsync+inotify实时同步</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#unisoninotify%E5%AE%9E%E7%8E%B0%E5%8F%8C%E5%90%91%E6%95%B0%E6%8D%AE%E5%90%8C%E6%AD%A5"><span class="nav-number">12.4.</span> <span class="nav-text">unison+inotify实现双向数据同步</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#javaweb%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA"><span class="nav-number">13.</span> <span class="nav-text">JavaWeb环境搭建</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%89%E8%A3%85jdk"><span class="nav-number">13.1.</span> <span class="nav-text">安装JDK</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%89%E8%A3%85tomcat"><span class="nav-number">13.2.</span> <span class="nav-text">安装Tomcat</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#elk%E5%B9%B3%E5%8F%B0%E6%90%AD%E5%BB%BA"><span class="nav-number">14.</span> <span class="nav-text">ELK平台搭建</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%9E%E9%AA%8C%E9%83%A8%E7%BD%B2"><span class="nav-number">14.1.</span> <span class="nav-text">实验部署</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%85%B3%E7%B3%BB%E5%9E%8B%E6%95%B0%E6%8D%AE%E5%BA%93%E5%B9%B3%E5%8F%B0mysql"><span class="nav-number">15.</span> <span class="nav-text">关系型数据库平台(MySQL)</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%85%B3%E7%B3%BB%E5%9E%8B%E6%95%B0%E6%8D%AE%E5%BA%93%E7%90%86%E8%AE%BA%E5%9F%BA%E7%A1%80"><span class="nav-number">15.1.</span> <span class="nav-text">关系型数据库理论基础</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E5%9F%BA%E7%A1%80%E4%BF%A1%E6%81%AF"><span class="nav-number">15.2.</span> <span class="nav-text">MySQL基础信息</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E5%9F%BA%E7%A1%80%E5%91%BD%E4%BB%A4"><span class="nav-number">15.3.</span> <span class="nav-text">MySQL基础命令</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%95%B0%E6%8D%AE%E5%BA%93%E7%9A%84%E5%A4%87%E4%BB%BD%E5%92%8C%E8%BF%98%E5%8E%9F"><span class="nav-number">15.4.</span> <span class="nav-text">数据库的备份和还原</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E4%B8%BB%E4%BB%8E%E5%A4%87%E4%BB%BD"><span class="nav-number">15.5.</span> <span class="nav-text">MySQL主从备份</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E4%B8%BB%E4%B8%BB%E5%A4%87%E4%BB%BD"><span class="nav-number">15.6.</span> <span class="nav-text">MySQL主主备份</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E4%B8%80%E4%B8%BB%E5%A4%9A%E4%BB%8E"><span class="nav-number">15.7.</span> <span class="nav-text">MySQL一主多从</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E5%A4%9A%E4%B8%BB%E4%B8%80%E4%BB%8E"><span class="nav-number">15.8.</span> <span class="nav-text">MySQL多主一从</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#mysql%E8%AF%BB%E5%86%99%E5%88%86%E7%A6%BB"><span class="nav-number">15.9.</span> <span class="nav-text">MySQL读写分离</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E9%9D%9E%E5%85%B3%E7%B3%BB%E5%9E%8B%E6%95%B0%E6%8D%AE%E5%BA%93%E5%B9%B3%E5%8F%B0redis"><span class="nav-number">16.</span> <span class="nav-text">非关系型数据库平台(Redis)</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%9C%A8centos7%E4%B8%8B%E5%AE%89%E8%A3%85redis"><span class="nav-number">16.1.</span> <span class="nav-text">在CentOS7下安装Redis</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%95%B0%E6%8D%AE%E7%B1%BB%E5%9E%8B"><span class="nav-number">16.2.</span> <span class="nav-text">数据类型</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%85%B6%E4%BB%96%E7%9B%B8%E5%85%B3%E5%91%BD%E4%BB%A4"><span class="nav-number">16.3.</span> <span class="nav-text">其他相关命令</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#redis-%E9%AB%98%E7%BA%A7%E5%BA%94%E7%94%A8"><span class="nav-number">16.4.</span> <span class="nav-text">Redis 高级应用</span></a></li></ol></li></ol></div>
        </div>
        <!--/noindex-->

        <div class="site-overview-wrap sidebar-panel">
          <div class="site-author site-overview-item animated" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="Liu Kairui"
      src="/images/avatar.jpg">
  <p class="site-author-name" itemprop="name">Liu Kairui</p>
  <div class="site-description" itemprop="description">LiuKairui Persional Website</div>
</div>
<div class="site-state-wrap site-overview-item animated">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
        <a href="/archives/">
          <span class="site-state-item-count">45</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
          <a href="/categories/">
        <span class="site-state-item-count">24</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
          <a href="/tags/">
        <span class="site-state-item-count">53</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>
  <div class="links-of-author site-overview-item animated">
      <span class="links-of-author-item">
        <a href="https://github.com/KairuiLiu" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;KairuiLiu" rel="noopener" target="_blank"><i class="fab fa-github fa-fw"></i>GitHub</a>
      </span>
      <span class="links-of-author-item">
        <a href="mailto:tclkr@live.com" title="E-Mail → mailto:tclkr@live.com" rel="noopener" target="_blank"><i class="fa fa-envelope fa-fw"></i>E-Mail</a>
      </span>
      <span class="links-of-author-item">
        <a href="https://qm.qq.com/cgi-bin/qm/qr?k=oaf3ToOlN17hr5sHV98bT8qxsNYGaw5L&noverify=0" title="QQ → https:&#x2F;&#x2F;qm.qq.com&#x2F;cgi-bin&#x2F;qm&#x2F;qr?k&#x3D;oaf3ToOlN17hr5sHV98bT8qxsNYGaw5L&amp;noverify&#x3D;0" rel="noopener" target="_blank"><i class="fab fa-qq fa-fw"></i>QQ</a>
      </span>
      <span class="links-of-author-item">
        <a href="/atom.xml" title="RSS → &#x2F;atom.xml"><i class="fa fa-rss fa-fw"></i>RSS</a>
      </span>
      <span class="links-of-author-item">
        <a href="https://liukairui.blog.csdn.net/" title="CSDN → https:&#x2F;&#x2F;liukairui.blog.csdn.net" rel="noopener" target="_blank"><i class="fab fa-cuttlefish fa-fw"></i>CSDN</a>
      </span>
      <span class="links-of-author-item">
        <a href="http://liukairui.cc/" title="国内站点 → http:&#x2F;&#x2F;liukairui.cc" rel="noopener" target="_blank"><i class="fa fa-globe fa-fw"></i>国内站点</a>
      </span>
  </div>
  <div class="cc-license site-overview-item animated" itemprop="license">
    <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/deed.zh" class="cc-opacity" rel="noopener" target="_blank"><img src="https://cdnjs.cloudflare.com/ajax/libs/creativecommons-vocabulary/2020.11.3/assets/license_badges/small/by_nc_sa.svg" alt="Creative Commons"></a>
  </div>


  <div class="links-of-blogroll site-overview-item animated">
    <div class="links-of-blogroll-title"><i class="fa fa-link fa-fw"></i>
      友情链接
    </div>
    <ul class="links-of-blogroll-list">
        <li class="links-of-blogroll-item">
          <a href="https://paste.ubuntu.com/" title="https:&#x2F;&#x2F;paste.ubuntu.com&#x2F;" rel="noopener" target="_blank">Ubuntu Pastebin</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="https://send.firefox.com/" title="https:&#x2F;&#x2F;send.firefox.com&#x2F;" rel="noopener" target="_blank">Firefox Send</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="https://jkwzs.cn/" title="https:&#x2F;&#x2F;jkwzs.cn&#x2F;" rel="noopener" target="_blank">南花醉笔丶の个人博客</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="https://ywrby.cn/" title="https:&#x2F;&#x2F;ywrby.cn&#x2F;" rel="noopener" target="_blank">Ywrby个人博客</a>
        </li>
    </ul>
  </div>

        </div>
      </div>
    </div>
  </aside>
  <div class="sidebar-dimmer"></div>


    </header>

    
  <div class="back-to-top" role="button" aria-label="返回顶部">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>

<noscript>
  <div class="noscript-warning">Theme NexT works best with JavaScript enabled</div>
</noscript>


    <div class="main-inner post posts-expand">


  


<div class="post-block">
  
  

  <article itemscope itemtype="http://schema.org/Article" class="post-content" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="http://liukairui.me/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/avatar.jpg">
      <meta itemprop="name" content="Liu Kairui">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="LiuKairui Website">
      <meta itemprop="description" content="LiuKairui Persional Website">
    </span>
    
    <span hidden itemprop="post" itemscope itemtype="http://schema.org/CreativeWork">
      <meta itemprop="name" content="Linux网络服务与数据库笔记 | LiuKairui Website">
      <meta itemprop="description" content="尚硅谷Linux运维网络服务部分, 由刘川老师讲解, 介绍了常见网络服务DNCP,DNS,FTP,SAMBA...与LAMP,ANMP平台搭建, 数据库平台搭建,主讲:尚硅谷沈超与刘川,视频来自B站:BV164411J761">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          Linux网络服务与数据库笔记
        </h1>

        <div class="post-meta-container">
          <div class="post-meta">
    <span class="post-meta-item">
      <span class="post-meta-item-icon">
        <i class="far fa-calendar"></i>
      </span>
      <span class="post-meta-item-text">发表于</span>

      <time title="创建时间：2021-04-08 00:00:01" itemprop="dateCreated datePublished" datetime="2021-04-08T00:00:01+08:00">2021-04-08</time>
    </span>
    <span class="post-meta-item">
      <span class="post-meta-item-icon">
        <i class="far fa-folder"></i>
      </span>
      <span class="post-meta-item-text">分类于</span>
        <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
          <a href="/categories/%E8%BF%90%E7%BB%B4/" itemprop="url" rel="index"><span itemprop="name">运维</span></a>
        </span>
    </span>

  
    <span id="/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/" class="post-meta-item leancloud_visitors" data-flag-title="Linux网络服务与数据库笔记" title="阅读次数">
      <span class="post-meta-item-icon">
        <i class="far fa-eye"></i>
      </span>
      <span class="post-meta-item-text">阅读次数：</span>
      <span class="leancloud-visitors-count"></span>
    </span>
  
  <span class="post-meta-item">
    
    <span class="post-meta-item-icon">
      <i class="far fa-comment"></i>
    </span>
    <span class="post-meta-item-text">Valine：</span>
  
    <a title="valine" href="/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/#valine-comments" itemprop="discussionUrl">
      <span class="post-comments-count valine-comment-count" data-xid="/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/" itemprop="commentCount"></span>
    </a>
  </span>
  
  

<script>
    CONFIG.hostname = location.hostname;
</script>
    <span class="post-meta-break"></span>
    <span class="post-meta-item" title="本文字数">
      <span class="post-meta-item-icon">
        <i class="far fa-file-word"></i>
      </span>
      <span class="post-meta-item-text">本文字数：</span>
      <span>92k</span>
    </span>
    <span class="post-meta-item" title="阅读时长">
      <span class="post-meta-item-icon">
        <i class="far fa-clock"></i>
      </span>
      <span class="post-meta-item-text">阅读时长 &asymp;</span>
      <span>1:24</span>
    </span>
</div>

            <div class="post-description">尚硅谷Linux运维网络服务部分, 由刘川老师讲解, 介绍了常见网络服务DNCP,DNS,FTP,SAMBA...与LAMP,ANMP平台搭建, 数据库平台搭建,主讲:尚硅谷沈超与刘川,视频来自B站:BV164411J761</div>
        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">
        <p>首先说明我使用的环境</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># uname -a</span>
Linux C7B1 <span class="token number">3.10</span>.0-1160.el7.x86_64 <span class="token comment">#1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux</span>
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># cat /proc/version </span>
Linux version <span class="token number">3.10</span>.0-1160.el7.x86_64 <span class="token punctuation">(</span>mockbuild@kbuilder.bsys.centos.org<span class="token punctuation">)</span> <span class="token punctuation">(</span>gcc version <span class="token number">4.8</span>.5 <span class="token number">20150623</span> <span class="token punctuation">(</span>Red Hat <span class="token number">4.8</span>.5-44<span class="token punctuation">)</span> <span class="token punctuation">(</span>GCC<span class="token punctuation">)</span> <span class="token punctuation">)</span> <span class="token comment">#1 SMP Mon Oct 19 16:18:59 UTC 2020</span>
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># cat /etc/issue</span>
<span class="token punctuation">\</span>S
Kernel <span class="token punctuation">\</span>r on an <span class="token punctuation">\</span>m
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># cat /etc/redhat-release </span>
CentOS Linux release <span class="token number">7.9</span>.2009 <span class="token punctuation">(</span>Core<span class="token punctuation">)</span></code></pre>
<p>以下实验，如无特殊说明均指的是 CentOS7 关闭防火墙与SELinux</p>
<h2 id="网络基础服务">网络基础服务</h2>
<h3 id="centos6与centos7区别">CentOS6与CentOS7区别</h3>
<p><strong>常见命令</strong></p>
<table>
<colgroup>
<col style="width: 5%" />
<col style="width: 25%" />
<col style="width: 34%" />
<col style="width: 34%" />
</colgroup>
<thead>
<tr class="header">
<th>项目</th>
<th>CentOS6.x</th>
<th>CentOS7.x</th>
<th>区别</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>文件系统</td>
<td>ext4</td>
<td>xfs(性能好，速度快)</td>
<td>使用的时候ext4的瓶颈都很难达到，感知不强</td>
</tr>
<tr class="even">
<td>内核</td>
<td>2.6.x-x</td>
<td>3.10.x-x</td>
<td>内核存在大升级导致防火墙等变化</td>
</tr>
<tr class="odd">
<td>防火墙</td>
<td>iptables</td>
<td>firewalld</td>
<td>后者优秀，感知不强，短期不会取而代之，大多数人习惯安装7后再重装iptables</td>
</tr>
<tr class="even">
<td>默认数据库</td>
<td>MySQL</td>
<td>MariaDB</td>
<td>两者几乎相同，更换只是防止版权纠纷，MySQL优化方案比较成熟，短期不会取而代之</td>
</tr>
<tr class="odd">
<td>时间同步</td>
<td>ntpq -p</td>
<td>chronyc sources</td>
<td></td>
</tr>
<tr class="even">
<td>修改时区</td>
<td>/etc/sysconfig/clock加入ZONE="Asia/Shanghai"</td>
<td>timedatectl set-timezone Asia/Shanghai</td>
<td>7的命令实际上就是修改了6的配置文件</td>
</tr>
<tr class="odd">
<td>修改语言</td>
<td>/etc/sysconfig/i18n写入LANG="zh_CN.UTF-8"</td>
<td>localectl set-locale LANG=zh_CN.UTF-8</td>
<td>这个指的是终端的语言，自己不要改，怕不支持给乱码</td>
</tr>
<tr class="even">
<td>主机名</td>
<td>/etc/sysconfig/network写入</td>
<td>/etc/hostname写入或者hostnamectl set-hostname XXX，全是永久生效</td>
<td>主机名有一个设置要求，完整主机名是主机名.localhost.localdomain，不遵守也问题不大</td>
</tr>
</tbody>
</table>
<p><strong>网络命令</strong></p>
<table>
<colgroup>
<col style="width: 27%" />
<col style="width: 33%" />
<col style="width: 38%" />
</colgroup>
<thead>
<tr class="header">
<th>操作</th>
<th>CentOS6.x</th>
<th>CentOS7.x</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>启动服务</td>
<td>service 服务名 start</td>
<td>systemctl start 服务名</td>
</tr>
<tr class="even">
<td>关闭服务</td>
<td>service 服务名 stop</td>
<td>systemctl stop 服务名</td>
</tr>
<tr class="odd">
<td>重启服务</td>
<td>service 服务名 restart</td>
<td>systemctl restart 服务名</td>
</tr>
<tr class="even">
<td>查看所有服务状态</td>
<td>service --status-all</td>
<td>systemctl list-units</td>
</tr>
<tr class="odd">
<td>查看某个服务状态</td>
<td>service 服务名 status</td>
<td>systemctl statu 服务名</td>
</tr>
<tr class="even">
<td>设置自启动</td>
<td>chkconfig 服务名 on</td>
<td>systemctl enable 服务</td>
</tr>
<tr class="odd">
<td>设置不自启动</td>
<td>chkconfig 服务名 off</td>
<td>systemctl disable 服务</td>
</tr>
<tr class="even">
<td>查看所有自启动状态</td>
<td>chkconfig --list</td>
<td>systemctl list-unit-files</td>
</tr>
</tbody>
</table>
<p>CentOS7中所有的服务后面加上了.service，例如<code>httpd.service</code>这个写法的变化在CentOS7.0.x,CentOS7.1.x是必须的，但是后来RedHat加不加都可以了</p>
<p><strong>网络配置</strong></p>
<table>
<thead>
<tr class="header">
<th>项目</th>
<th>CentOS6.x</th>
<th>CentOS7.x</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>网卡名</td>
<td>eth0</td>
<td>ens33(7.0-7.5是ens+随机数)</td>
</tr>
<tr class="even">
<td>网络配置</td>
<td>ifconfig/setup</td>
<td>ip/nmtui</td>
</tr>
<tr class="odd">
<td>网络服务名</td>
<td>network</td>
<td>NetworkManager(network作为备用)</td>
</tr>
</tbody>
</table>
<p><strong>网卡配置与网卡修改</strong></p>
<p>网卡的配置文件在<code>/etc/sysconfig/network-scripts/ifcfg-enp0s3</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">TYPE</span><span class="token operator">=</span>Ethernet
<span class="token assign-left variable">PROXY_METHOD</span><span class="token operator">=</span>none
<span class="token assign-left variable">BROWSER_ONLY</span><span class="token operator">=</span>no
<span class="token assign-left variable">BOOTPROTO</span><span class="token operator">=</span>dhcp							<span class="token comment"># 网络连接模式 dhcp动态，static静态IP</span>
<span class="token assign-left variable">DEFROUTE</span><span class="token operator">=</span>yes
<span class="token assign-left variable">IPV4_FAILURE_FATAL</span><span class="token operator">=</span>no
<span class="token assign-left variable">IPV6INIT</span><span class="token operator">=</span>yes
<span class="token assign-left variable">IPV6_AUTOCONF</span><span class="token operator">=</span>yes
<span class="token assign-left variable">IPV6_DEFROUTE</span><span class="token operator">=</span>yes
<span class="token assign-left variable">IPV6_FAILURE_FATAL</span><span class="token operator">=</span>no
<span class="token assign-left variable">IPV6_ADDR_GEN_MODE</span><span class="token operator">=</span>stable-privacy
<span class="token assign-left variable">NAME</span><span class="token operator">=</span>enp0s3								<span class="token comment"># 网卡名</span>
<span class="token assign-left variable">UUID</span><span class="token operator">=</span>ddc655f4-514a-499e-bbca-8dd27fa91684
<span class="token assign-left variable">DEVICE</span><span class="token operator">=</span>enp0s3							<span class="token comment"># 设备名</span>
<span class="token assign-left variable">ONBOOT</span><span class="token operator">=</span>yes								<span class="token comment"># 开机加载</span></code></pre>
<p>和CentOS6比起来就是多了IPv6的配置，注意大小写，<strong>等号左面大写，右面小写</strong>，如果可以用nmtui解决不要用这个</p>
<p><strong>将enp0s3换为eth0</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># cd /etc/sysconfig/network-scripts/						# 进入目录</span>
<span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># ls ifcfg-enp0s3</span>
ifcfg-enp0s3
<span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># cp -a ifcfg-enp0s3 ifcfg-enp0s3.back		# 备份原文件</span>
<span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># mv ifcfg-enp0s3 ifcfg-eth0			    # 修改文件名</span>
<span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># vim ifcfg-eth0						   # 修改配置文件</span></code></pre>
<p>修改网卡配置信息，改两处</p>
<pre class="language-diff" data-language="diff"><code class="language-diff">TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=dhcp
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> NAME=enp0s3
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> NAME=eth0
</span></span>UUID=ddc655f4-514a-499e-bbca-8dd27fa91684
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> DEVICE=enp0s3
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> DEVICE=eth0
</span></span>ONBOOT=yes</code></pre>
<p>修改GRUB配置，关闭一致性命名规则(就是不让内核算名字)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># vim /etc/default/grub</span></code></pre>
<pre class="language-diff" data-language="diff"><code class="language-diff">GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> GRUB_CMDLINE_LINUX="crashkernel=auto rhgb quiet"
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> GRUB_CMDLINE_LINUX="crashkernel=auto rhgb quiet net.ifnames=0 biosdevname=0"
</span></span>GRUB_DISABLE_RECOVERY="true"</code></pre>
<p>更新配置文件加载新的参数，重启</p>
<pre class="language-shell" data-language="shell"><code class="language-shell"><span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># grub2-mkconfig -o /boot/grub2/grub.cfg</span>
<span class="token punctuation">[</span>root@bogon network-scripts<span class="token punctuation">]</span><span class="token comment"># reboot</span></code></pre>
<p>注意，CentOS7.x用的是Grub2，配置文件变化到<code>/etc/default/grub</code>，<code>/boot/grub2/grub.cfg</code>是grub2-mkconfig生成的</p>
<h3 id="常见的网络协议与端口">常见的网络协议与端口</h3>
<ul>
<li><p>网络地址与物理地址：</p>
<p>IP地址是互联网协议地址，作用是为了给每个连接局域网的设备一个独一无二的数字地址，10.X.X.X，172.16.X.X-172.31.X.X.X，192.168.X.X是内网IP段</p>
<p>MAC地址是物理地址，是为每一个设备设置一个固定的硬件地址，MAC工作在链路层，是一个12个16进制数</p></li>
<li><p>TCP/IP五层协议</p>
<p>应用层：FTP，HTTP，SMTP，Telnet，DNS...</p>
<p>传输层：TCP，UDP...</p>
<p>网络层：IP，ARP，ICMP...</p>
<p>数字链路：PPP，PPPop...</p>
<p>物理层：不常用</p></li>
<li><p>最常见网络端口</p>
<p>配置文件在：<code>/etc/service</code></p>
<table>
<thead>
<tr class="header">
<th>端口</th>
<th>服务</th>
<th>作用</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>20/21</td>
<td>FTP</td>
<td>文件共享</td>
</tr>
<tr class="even">
<td>22</td>
<td>ssh</td>
<td>远程管理</td>
</tr>
<tr class="odd">
<td>23</td>
<td>Telnet</td>
<td>不安全的远程管理</td>
</tr>
<tr class="even">
<td>25</td>
<td>smtp</td>
<td>发邮件</td>
</tr>
<tr class="odd">
<td>465</td>
<td>smtp(SSL)</td>
<td>发邮件</td>
</tr>
<tr class="even">
<td>110</td>
<td>pop3</td>
<td>收邮件</td>
</tr>
<tr class="odd">
<td>143</td>
<td>IMAP4</td>
<td>收邮件</td>
</tr>
<tr class="even">
<td>993</td>
<td>IMAP4(SSL)</td>
<td>收邮件</td>
</tr>
<tr class="odd">
<td>80</td>
<td>www服务http</td>
<td>网页访问</td>
</tr>
<tr class="even">
<td>443</td>
<td>www服务https</td>
<td>加密网页访问</td>
</tr>
<tr class="odd">
<td>3306</td>
<td>musql端口</td>
<td>数据库链接端口</td>
</tr>
<tr class="even">
<td>53</td>
<td>DNS端口</td>
<td>域名解析端口</td>
</tr>
</tbody>
</table>
<ul>
<li>FTP有两个端口，21是长期监听的，用于登录等验证，具体文件传输走20端口</li>
<li>SMTP有两个，一个是加密的，一个没加密</li>
<li>pop3只能收文本文件，想要图片需要IMAP</li>
</ul></li>
</ul>
<h3 id="网关和路由">网关和路由</h3>
<p><strong>路由具有跨网段通信与路由选择的能力</strong></p>
<ul>
<li>一个局域网中的设备可能需要访问另一个局域网中的设备，这个时候就需要路由器作为连接</li>
<li>一个网段去另一个网段可能有很多路可以走，这时候根据路由协议的不同路由器可能会规划出不同的走法
路由有动态路由与动态路由，静态是规定路线的，计算少，但是网络情况变化就要修改所有路由，适合局域网，动态是自动寻路的</li>
</ul>
<p><strong>网关</strong></p>
<ul>
<li>网关首先必须是一个路由(可以是虚拟的也可以是真实的)，所以具有<strong>路由转发与自动寻路</strong>的能力</li>
<li>网关可以<strong>默认路由</strong>，只要是<strong>电脑处理不了</strong>的都会交给网关进行路由</li>
<li>网关可以进行NAT转换例如一个内网IP想要访问公网IP，可以经过网关，网关可以记下下这个数据包，重新包装，转发(例如几下这个包是内网ip10.65.1.1发来的，然后将这个数据包打包，用自己的公网IP名义发出，等收到包后根据包的特征返还非10.65.1.1)</li>
</ul>
<p><strong>网关是逻辑概念,路由器是物理设备</strong>,路由器可以作为网关来使用。<strong>路由器是一个设备，而网关是一个结点（概念层）</strong>。应该说：路由器可以实现网关的功能。另外，网关的功能还可以由局域网中一台双网卡的机器（其中一块网卡接入广域网）来实现。</p>
<ul>
<li><p>查询路由表</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># route -n</span>
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
<span class="token number">10.0</span>.2.0        <span class="token number">0.0</span>.0.0         <span class="token number">255.255</span>.255.0   U     <span class="token number">100</span>    <span class="token number">0</span>        <span class="token number">0</span> eth0
<span class="token number">192.168</span>.122.0   <span class="token number">0.0</span>.0.0         <span class="token number">255.255</span>.255.0   U     <span class="token number">0</span>      <span class="token number">0</span>        <span class="token number">0</span> virbr0</code></pre>
<p>我们可以看到这是本机可以处理几个路由表，这是没有配配置网关的情况，当配置网关后，下方会显示一个默认路由，网关进行处理</p></li>
<li><p>临时修改网关</p>
<p>添加：<code>route add default gw 网关的地址(路由器的地址)</code></p>
<p>添加：<code>route del default gw 网关的地址(路由器的地址)</code></p>
<p>之后查询可以看到</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># route -n</span>
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
<span class="token number">0.0</span>.0.0         <span class="token number">10.0</span>.2.2        <span class="token number">0.0</span>.0.0         UG    <span class="token number">100</span>    <span class="token number">0</span>        <span class="token number">0</span> eth0
<span class="token number">10.0</span>.2.0        <span class="token number">0.0</span>.0.0         <span class="token number">255.255</span>.255.0   U     <span class="token number">100</span>    <span class="token number">0</span>        <span class="token number">0</span> eth0
<span class="token number">192.168</span>.122.0   <span class="token number">0.0</span>.0.0         <span class="token number">255.255</span>.255.0   U     <span class="token number">0</span>      <span class="token number">0</span>        <span class="token number">0</span> virbr0</code></pre>
<p>最上面这个0.0.0.0意思是任意ip，意思是，不在下面这几个ip列表的ip本机没法路由，就直接交给网关10.0.2.2路由</p></li>
</ul>
<h3 id="网络管理命令">网络管理命令</h3>
<ul>
<li><p>DNS解析测试命令</p>
<ul>
<li><p>可以用过<code>nslookup</code>进行测试</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># nslookup www.baidu.com</span>
Server:         <span class="token number">192.168</span>.43.1
Address:        <span class="token number">192.168</span>.43.1<span class="token comment">#53</span>

Non-authoritative answer:
Name:   www.baidu.com
Address: <span class="token number">112.80</span>.248.76
Name:   www.baidu.com
Address: <span class="token number">112.80</span>.248.75
www.baidu.com   canonical name <span class="token operator">=</span> www.a.shifen.com.</code></pre></li>
<li><p>修改一张网卡的DNS</p>
<p><code>/etc/sysconfig/network-scripts/ifcfg-eth0</code>文件下<code>DNS1=ip</code>,<code>DNS2=ip</code>...</p>
<p>或者使用setup</p></li>
<li><p>修改全局DNS</p>
<p><code>/etc/resolv.conf</code>文件下<code>nameserver ip</code></p>
<p>或者使用setup</p></li>
<li><p>hosts文件</p>
<p><code>/etc/hosts</code>文件下是静态的解析记录，优先级高于DNS解析</p></li>
</ul></li>
<li><p>网络查看命令</p>
<p>查看网络连接与端口：<code>netstat -tuln</code></p>
<p>查看进程，网络连接与端口：<code>netstat -tulnp</code></p>
<p>查看所有不管是否连接的活动：<code>netstat -an</code></p></li>
<li><p>查询本机和目标主机经过的节点数，路由追踪</p>
<p><code>traceroute [选项] 网址</code></p>
<ul>
<li><code>-p</code> 指定UDP端口测试(默认是ICMP)</li>
<li><code>-q n</code>指定测试n次</li>
<li><code>n</code>以IP的方式测试，避开DNS</li>
</ul>
<p>注意这个功能在虚拟机NAT模式下无法实现，想要实现开机桥接模式</p>
<p>这个可以测试主机连接效率</p>
<p>这个功能的原理就是尝试去ping网址，成功之后就去ping他指向的网站，但是这个功能成功率不断下降，原因是很多网址禁止了这种ping</p></li>
<li><p>测试网络连通性</p>
<p><code>ping 网站</code></p>
<p>选项</p>
<ul>
<li><code>-i</code> 间隔时间</li>
<li><code>-c</code>ping的次数</li>
<li><code>-s</code>数据包的大小</li>
</ul></li>
<li><p>地址解析，将ip转化为mac</p>
<p><code>arp ip</code></p>
<p>选项</p>
<ul>
<li><code>-a</code>查看曾经与本机连接过的所有设备的mac</li>
<li><code>-d ip</code>删除某个ip的记录</li>
</ul></li>
<li><p>网络探测命令</p>
<p><code>nmap</code>命令，默认不安装</p>
<p>选项</p>
<ul>
<li><code>-sP</code>
扫描网段内有哪些计算机，例如<code>nmap -sP 10.0.2.0/24</code>子网掩码为24，网段为10.0.2.0，对方必须关闭防火墙才扫的到</li>
<li><code>-sT</code> 查询指定ip开了哪些端口</li>
</ul></li>
<li><p>常见的远程工具</p>
<ul>
<li>Windows管理Linux：Xshell SecureCRT</li>
<li>Linux管理Windows：rdesktop</li>
<li>Linux管理Linux：SSH</li>
</ul></li>
</ul>
<h3 id="ssh管理">SSH管理</h3>
<ul>
<li><p>什么是SSH</p>
<p>是Secure Shell缩写，与之前的Telnet比起来非明文传输，比较安全</p></li>
<li><p>SSH的登录验证模式</p>
<p>有账户密码验证与密钥对连接两种模式</p></li>
</ul>
<p><strong>账户密码验证登录模式</strong></p>
<ul>
<li>客户端尝试发送连接请求(问问能不能远程连接)</li>
<li>服务器生成和发送公钥给计算机</li>
<li>客户端使用公钥加密信息，发送</li>
<li>服务器解密验证</li>
</ul>
<p><strong>密钥对的登录验证模式</strong></p>
<ul>
<li>客户端向服务器发送连接请求和自己的<strong>客户端的公钥</strong>文件，服务器收到后直接返回<strong>服务器的公钥</strong></li>
<li>服务器检查到自己没有客户端公钥时：
<ul>
<li>返回没有收到客户端的公钥</li>
</ul></li>
<li>服务器检查到有公钥的时候
<ul>
<li>服务器返回一段使用<strong>客户端的公钥</strong>加密的challenge（随便找了点内容加密）</li>
<li>客户端用<strong>客户端的私钥</strong>解密，然后用<strong>服务器的公钥</strong>加密</li>
<li>服务器用<strong>服务器的私钥</strong>解密验证到和之前自己找的那个内容一样</li>
</ul></li>
<li><strong>注意</strong>：在连接之前客户端要想办法把自己的公钥放在服务器上</li>
</ul>
<p><strong>SSH连接实验</strong></p>
<ul>
<li><p>环境准备</p>
<ul>
<li><p>修改主机名以方便识别</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># uname -n					# 查看主机名</span>
bogon
<span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/sysconfig/network	# 修改主机名</span></code></pre></p>
<p><pre class="language-diff" data-language="diff"><code class="language-diff">NETWORKING=yes
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> HOSTNAME=localhost.localdomain
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> HOSTNAME=KarryZenBook14s</span></span></code></pre></p>
<p>注意，主机名规范应该是X.Y但是不写成这种格式基本不影响，最多有两个waring</p>
<p>如果需要立即生效还需要修改hosts文件</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@bogon ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/hosts</span></code></pre></p>
<p>将原主机名(localhost.localdomain)换成新的(KarryZenBook14s)注意原主机名是一个整体，第一列那个localhost不是主机名</p>
<pre class="language-diff" data-language="diff"><code class="language-diff"><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> 127.0.0.1   localhost KarryZenBook14s localhost4 localhost4.localdomain4
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> ::1         localhost KarryZenBook14s localhost6 localhost6.localdomain6</span></span></code></pre>
<p>重启</p></li>
<li><p>关闭防火墙和SELinux</p>
<p>永久关闭防护(重启生效)</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># chkconfig iptables off	# 关闭防火墙自启</span>
<span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/selinux/config</span></code></pre></p>
<p>修改SELinux配置</p>
<p><pre class="language-diff" data-language="diff"><code class="language-diff">#     disabled - No SELinux policy is loaded.
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> SELINUX=enforcing
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> SELINUX=disabled
</span></span># SELINUXTYPE= can take one of these two values:</code></pre></p>
<p>临时关闭防火墙和SELinux</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># iptables -F		# 注意，这里不是关闭了防火墙，是清空了防火墙规则</span>
<span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># setenforce 0</span></code></pre></p></li>
</ul></li>
<li><p>用户密码验证连接(客户端Windows与Linux均可)</p>
<p><code>ssh</code>命令：<code>ssh [-l username] [-p port] ip地址</code>，这里<code>-l</code>指定用户不写会自动root登录，<code>-p</code>指定端口，不写默认22，如果虚拟机是NAT的还是要写端口，例如</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">PS C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr<span class="token operator">></span> <span class="token function">ssh</span> -l root -p <span class="token number">9001</span> <span class="token number">127.0</span>.0.1</code></pre>
<p>退出连接：<code>exit</code>或者<code>Ctrl+D</code></p></li>
<li><p>使用密钥对连接(客户端Windows与Linux均可)</p>
<ul>
<li><p>在客户端生成客户端的公钥与私钥</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">PS C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr<span class="token operator">></span> ssh-keygen -t rsa -b <span class="token number">2048</span>
Generating public/private rsa key pair.
Enter <span class="token function">file</span> <span class="token keyword">in</span> <span class="token function">which</span> to save the key <span class="token punctuation">(</span>C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr/.ssh/id_rsa<span class="token punctuation">)</span>:
<span class="token comment"># 询问存放位置</span>
Enter passphrase <span class="token punctuation">(</span>empty <span class="token keyword">for</span> no passphrase<span class="token punctuation">)</span>:
Enter same passphrase again:
<span class="token comment"># 询问是否加密</span>
Your identification has been saved <span class="token keyword">in</span> C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr/.ssh/id_rsa.
Your public key has been saved <span class="token keyword">in</span> C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:xfRZov/YP/9Jas0OcLmTZ1vlPv3Ka3dmgUP65yENgHY tclkr@KarryZenBook14s
The key's randomart image is:
+---<span class="token punctuation">[</span>RSA <span class="token number">2048</span><span class="token punctuation">]</span>----+
<span class="token operator">|</span>          <span class="token builtin class-name">.</span> <span class="token builtin class-name">.</span> <span class="token builtin class-name">.</span>  <span class="token operator">|</span>
<span class="token operator">|</span>         o.o +   <span class="token operator">|</span>
<span class="token operator">|</span>         o+Eo    <span class="token operator">|</span>
<span class="token operator">|</span>        <span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span>.  <span class="token operator">|</span>
<span class="token operator">|</span>        S  .++. <span class="token builtin class-name">.</span><span class="token operator">|</span>
<span class="token operator">|</span>           .o*<span class="token operator">=</span>o.<span class="token operator">|</span>
<span class="token operator">|</span>            o***<span class="token operator">=</span><span class="token operator">|</span>
<span class="token operator">|</span>             +XO@<span class="token operator">|</span>
<span class="token operator">|</span>            .oB@<span class="token operator">&amp;</span><span class="token operator">|</span>
+----<span class="token punctuation">[</span>SHA256<span class="token punctuation">]</span>-----+</code></pre>
<ul>
<li><code>-t</code>加密方式，设置为rsa</li>
<li><code>-b</code>密钥长度</li>
<li>询问密钥位置的时候直接回车保存在默认的家目录的/.ssh/id_rsa，在Linux上可能是/root，也可能是/home</li>
<li>之后询问是否加密私钥，这个是考虑到在不加密的情况下，如果别人获取到了计算机，就可以直接免密连接服务器，回车就是不加密，也可以连续两边输入私钥密码以后登录的时候输入私钥密码即可</li>
</ul></li>
<li><p>上传客户端公钥到服务器</p>
<p>不必使用scp/ftp，ssh有自己的命令</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">tclkr@KarryZenBook14s MINGW64 ~/Desktop
$ ssh-copy-id -p <span class="token number">9001</span> root@127.0.0.1
root@127.0.0.1<span class="token string">'s password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p '</span><span class="token number">9001</span><span class="token string">' '</span>root@127.0.0.1'"
and check to <span class="token function">make</span> sure that only the key<span class="token punctuation">(</span>s<span class="token punctuation">)</span> you wanted were added.</code></pre>
<p>ssh-copy-id可以直接复制，但是windows的PowerShell并没有这个命令，这里临时切换到了Windows的GitBash完成了操作，<code>-p</code>是指定端口</p>
<p>命令执行完，你的公钥(HOME/.ssh/id_rsa.pub)内容就被追加到了(Linux的HOME/.ssh/authorized_keys)</p>
<p>注意：这里<strong>填写的用户名就是未来你要登录的用户的用户名</strong>，不能写了一个用户还想免密登录到别的用户</p>
<p>注意：<strong>不得直接上传公钥文件</strong>，如果不用ssh-copy-id，请将文件复制下来，自己创建文件然后粘贴，而不是使用ftp/scp直接上传，因为Windows与Linux的换行格式不同！</p></li>
<li><p>登录服务器</p>
<p>与密码登录的命令一样，只不过免密了</p></li>
</ul></li>
<li><p>禁用密码登录</p>
<p>正常情况下是允许密钥对和密码同时登录的，但是密钥对明显安全等级高，可以禁用密码登录</p>
<p>修改配置文件(是sshd，d是deamon缩写，是守护程序的意思，一般服务的进程有d，客户端进程没有d)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/ssh/sshd_config</span></code></pre>
<p>搜索Password修改即可，<strong>注意P大写</strong></p>
<pre class="language-diff" data-language="diff"><code class="language-diff">#PasswordAuthentication yes
#PermitEmptyPasswords no
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> PasswordAuthentication yes
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> PasswordAuthentication no
</span></span># Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes</code></pre></li>
<li><p>禁止使用root远程登录</p>
<p>由于很多事故是root误操作造成的，建议ssh的时候禁止root登录，可以在需要的时候由普通用户su过去</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/ssh/sshd_config</span></code></pre>
<p>搜索RootLogin修改即可，<strong>注意R L大写</strong></p>
<pre class="language-diff" data-language="diff"><code class="language-diff">#LoginGraceTime 2m
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> #PermitRootLogin yes
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> PermitRootLogin no
</span></span>#StrictModes yes</code></pre></li>
<li><p>修改ssh默认端口</p>
<p>默认ssh是使用22口，为了防止攻击，我们可以修改端口，尽量使用1000-65536端口(1000-端酒容易被占用)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/ssh/sshd_config</span></code></pre>
<p>搜索Port修改即可，<strong>注意P大写</strong></p>
<pre class="language-diff" data-language="diff"><code class="language-diff"># possible, but leave them commented.  Uncommented options change a
# default value.

<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> #Port 22
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> Port 9000
</span></span>#AddressFamily any
#ListenAddress 0.0.0</code></pre>
<p>之后<code>ssh -p 9000 ip</code>，要是使用的是NAT，要修改NAT端口转发设置</p></li>
<li><p>限制ssh监听IP</p>
<p>在生产环境中服务器大都有两块网卡，一个对内，一个对外，对外的负责服务，对内的负责被管理，<strong>注意这里限制的是ssh被访问的ip，不是限制客户机IP</strong>，例如，有：客户机IP为10.1.1.1，服务器内网网卡IP为10.2.2.2，服务器外网网卡IP为：9.9.9.9，这个时候我们可以限制ssh只能连接到10.2.2.2不可连接到9.9.9.9，对公网暴露9.9.9.9这个IP。是限制服务器被连接的网卡IP不是客户机的IP！</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/ssh/sshd_config</span></code></pre>
<p>搜索ListenAddress修改即可，<strong>注意L A大写</strong></p>
<pre class="language-diff" data-language="diff"><code class="language-diff">#Port 22
#AddressFamily any
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> #ListenAddress 0.0.0.0
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> ListenAddress 内网IP
</span></span>#ListenAddress ::</code></pre></li>
<li><p><code>scp</code>命令</p>
<p>是一个安全的远程文件赋值命令，类似于命令cp，scp的传输是加密的，所以可能会影响一点速度，但是scp不是很站资源，不会提高多少系统负荷</p>
<p><code>scp [-P 端口] [-r] 源文件 username@ip:目标位置</code>
<code>-P</code>表示连接端口，scp默认是22口，<code>-r</code>递归复制,例如<code>scp -P 9000 -r ./download/httpd-2.2.9.tar.bz2  liukairui@127.0.0.1:/home/liukairui</code></p>
<p>当然，既然和cp差不多，也可以反向拷贝<code>scp [-P 端口] [-r] username@ip:源文件 目标位置</code></p>
<p>注意，ssh的端口是<code>-p</code>,scp的端口是<code>-P</code></p></li>
<li><p><code>sftp</code>命令</p>
<p>是一个安全的文件学出协议，几乎与ftp语法功能一样，但是由于使用了加密技术，安全但是低效，使用示例：<code>sftp -P 9001 liukairui@127.0.0.1</code></p>
<p>执行后进入一个交互界面，在这里的命令可能与Linux的相似，不一样，这里面的是独立的</p>
<ul>
<li><p><code>help</code>获取帮助</p></li>
<li><p><code>pwd</code>与<code>lpwd</code>，pwd指的是服务器当前工作路径，lpwd是登录这个服务器前宿主机的位置,l是local的意思，例如</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">sftp<span class="token operator">></span> <span class="token builtin class-name">pwd</span>
Remote working directory: /home/liukairui
sftp<span class="token operator">></span> lpwd
Local working directory: c:<span class="token punctuation">\</span>users<span class="token punctuation">\</span>tclkr</code></pre></li>
<li><p><code>cd</code>与<code>lcd</code>，cd进入服务器目录，lcd进入客户端的某个目录</p></li>
<li><p><code>ls</code>与<code>lls</code>，ls查看服务器目录，lls查看客户端的某个目录</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">sftp<span class="token operator">></span> <span class="token builtin class-name">cd</span> itisserverflod
sftp<span class="token operator">></span> <span class="token function">ls</span>
itisserverfile
sftp<span class="token operator">></span> lcd Desktop
sftp<span class="token operator">></span> lls
 驱动器 C 中的卷没有标签。
 卷的序列号是 E25C-B336

 C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr<span class="token punctuation">\</span>Desktop 的目录

<span class="token number">2021</span>/03/04  <span class="token number">11</span>:24    <span class="token operator">&lt;</span>DIR<span class="token operator">></span>          <span class="token builtin class-name">.</span>
<span class="token number">2021</span>/03/04  <span class="token number">11</span>:24    <span class="token operator">&lt;</span>DIR<span class="token operator">></span>          <span class="token punctuation">..</span>
<span class="token number">2021</span>/03/01  <span class="token number">23</span>:04            <span class="token number">10,337</span> <span class="token number">2021</span>.xlsx
               <span class="token number">1</span> 个文件         <span class="token number">10,337</span> 字节
               <span class="token number">2</span> 个目录 <span class="token number">212,300</span>,955,648 可用字节</code></pre></li>
<li><p><code>put</code>,<code>get</code>上传和下载文件到服务器</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">sftp<span class="token operator">></span> <span class="token builtin class-name">pwd</span>
Remote working directory: /home/liukairui/tmp
sftp<span class="token operator">></span> put .wakatime.cfg
Uploading .wakatime.cfg to /home/liukairui/tmp/.wakatime.cfg
.wakatime.cfg                             <span class="token number">100</span>%   <span class="token number">58</span>    <span class="token number">41</span>.6KB/s   00:00
sftp<span class="token operator">></span> <span class="token function">ls</span> -al
drwxrwxr-x    <span class="token number">2</span> liukairui liukairui     <span class="token number">4096</span> Mar  <span class="token number">5</span> 08:41 <span class="token builtin class-name">.</span>
drwx------    <span class="token number">6</span> liukairui liukairui     <span class="token number">4096</span> Mar  <span class="token number">5</span> 08:40 <span class="token punctuation">..</span>
-rw-rw-r--    <span class="token number">1</span> liukairui liukairui       <span class="token number">58</span> Mar  <span class="token number">5</span> 08:41 .wakatime.cfg</code></pre>
<pre class="language-bash" data-language="bash"><code class="language-bash">sftp<span class="token operator">></span> <span class="token builtin class-name">pwd</span>
Remote working directory: /home/liukairui/test
sftp<span class="token operator">></span> lpwd
Local working directory: c:<span class="token punctuation">\</span>users<span class="token punctuation">\</span>tclkr<span class="token punctuation">\</span>desktop
sftp<span class="token operator">></span> get .wakatime.db
Fetching /home/liukairui/test/.wakatime.db to .wakatime.db
/home/liukairui/test/.wakatime.db         <span class="token number">100</span>%   12KB   <span class="token number">4</span>.4MB/s   00:00
sftp<span class="token operator">></span> lls
 驱动器 C 中的卷没有标签。
 卷的序列号是 E25C-B336

 C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr<span class="token punctuation">\</span>Desktop 的目录

<span class="token number">2021</span>/03/05  08:45    <span class="token operator">&lt;</span>DIR<span class="token operator">></span>          <span class="token builtin class-name">.</span>
<span class="token number">2021</span>/03/05  08:45    <span class="token operator">&lt;</span>DIR<span class="token operator">></span>          <span class="token punctuation">..</span>
<span class="token number">2021</span>/03/05  08:45            <span class="token number">12,288</span> .wakatime.db
<span class="token number">2021</span>/03/01  <span class="token number">23</span>:04            <span class="token number">10,337</span> <span class="token number">2021</span>.xlsx
               <span class="token number">2</span> 个文件         <span class="token number">22,625</span> 字节
               <span class="token number">2</span> 个目录 <span class="token number">212,298</span>,076,160 可用字节</code></pre>
<p>注意sftp只能get服务器登录用户所属的文件</p></li>
<li><p>要是<code>-P</code>换端口不行可以尝试<code>-oPort=端口</code></p></li>
</ul></li>
</ul>
<h3 id="tcp-wrappers-简单防火墙">TCP Wrappers 简单防火墙</h3>
<p>一个Linux自带的简易版防火墙，比iptables弱，生产环境用的不多，是工作在传输层的安全工具，可以对<strong>有状态连接</strong>的<strong>TCP</strong>的<strong>特定</strong>服务，常见的服务有telnet，sshd，vsftpd，rpcbind</p>
<ul>
<li><p>查询服务是否被TCP Wrapper控制
先查询服务的命令所在位置(以ssh为例，但是我们要查的是服务端的，命令是sshd)
使用ldd静态的查看服务在执行的时候调用的库文件列表，使用grep查询有没有调用libwrap.so</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s itisserverflod<span class="token punctuation">]</span><span class="token comment"># which sshd</span>
/usr/sbin/sshd
<span class="token punctuation">[</span>root@KarryZenBook14s itisserverflod<span class="token punctuation">]</span><span class="token comment"># ldd /usr/sbin/sshd | grep libwrap.so</span>
        libwrap.so.0 <span class="token operator">=</span><span class="token operator">></span> /lib64/libwrap.so.0 <span class="token punctuation">(</span>0x00007f864052c000<span class="token punctuation">)</span></code></pre></p></li>
<li><p>TCP Wrappers的工作原理</p>
<p>当获取连接请求后，先读取系统管理员设置的访问控制文件，符合要求就会将连接原封不动的发送给服务，否则直接拒绝</p>
<p>控制文件的读取方式</p>
<ul>
<li>/etc/host.allow的权限比/etc/host.deny大</li>
<li>看到/etc/host.allow有则直接放行</li>
<li>看到/etc/host.allow无但是/etc/host.deny没有也放行</li>
<li>看到/etc/host.allow无但是/etc/host.deny有不放行</li>
<li>需要个别服务允许，其他拒绝需要把服务写在allow，deny上写all</li>
<li>需要拒绝部分直接在deny里面写要拒绝的</li>
</ul></li>
<li><p>TCP Wrappers的使用</p>
<p>编写规则是<code>service_list@host: client_list</code></p>
<ul>
<li><p>service_list 服务列表</p></li>
<li><p>host
<strong>服务器</strong>的ip，例如服务器有内网网卡IP为10.65.1.1和外网网卡2.2.2.2，我们希望只有内网网卡可以建立服务，可以在allow中将host写成10.65.1.1，不写就是哪个网卡均可</p></li>
<li><p>client_list
列出访问者的显示，多个可以用<code>,</code>或者空格隔开</p>
<ul>
<li>基于IP地址的：10.65.1.1(一个ip)，一个ip段<code>10.65.1.</code>，一个ip段<code>10.65.</code>注意，限制网段要这么写，不得写成<code>10.65..</code></li>
<li>基于主机名的：很少用，</li>
<li>基于ip/掩码的，10.65.1.1/255.255.255.0，在CentOS7中支持将掩码改为/24</li>
<li>其他规则写法：ALL和LOCAL</li>
</ul></li>
<li><p>限制网段用户访问ssh</p>
<p>修改限制文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@KarryZenBook14s ~<span class="token punctuation">]</span><span class="token comment"># vim /etc/hosts.deny</span></code></pre>
<p>添加规则，注意，希望限制<code>10.65.11.*</code>写<code>10.65.11.</code>，希望限制<code>10.65.*.*</code>写<code>10.65.</code>，不得写成<code>10.65..</code>，我们限制的是访问服务器的ssh所以写的是sshd</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">sshd:10.65.</code></pre>
<p>直接exit退出登录即可，这个服务的配置文件无需重启服务，尝试登录</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">PS C:<span class="token punctuation">\</span>Users<span class="token punctuation">\</span>tclkr<span class="token operator">></span> <span class="token function">ssh</span> -l root -p <span class="token number">9001</span> <span class="token number">127.0</span>.0.1
Last login: Fri Mar  <span class="token number">5</span> <span class="token number">10</span>:09:16 <span class="token number">2021</span> from <span class="token number">10.0</span>.2.2</code></pre></li>
</ul></li>
</ul>
<h2 id="dhcp服务">DHCP服务</h2>
<p>DHCP动态主机配置协议，是一种在<strong>局域网内</strong>的使用<strong>UDP</strong>的不可靠传输协议工作的协议，主要作用是集中<strong>管理分配</strong>网络资源，使得网络中的主机可以<strong>动态获取IP，网关，DNS</strong>...</p>
<h3 id="dhcp的工作原理">DHCP的工作原理</h3>
<p>所谓的DHCP就是给需要IP的机器分配IP地址，当机器不需要的时候就收回来，相当于租房子一样，有一个租期，快到的时候还需要报告是否续租</p>
<pre class="mermaid">sequenceDiagram
　　　participant DHCP客户机
　　　participant DHCP服务机
　　　DHCP客户机-->>DHCP服务机:  DHCP Discover
　　　DHCP服务机-->>DHCP客户机:  DHCP Offer
　　　DHCP客户机-->>DHCP服务机:  DHCP Request
　　　DHCP服务机-->>DHCP客户机:  DHCP ACK/NAL</pre>
<p>可以这样粗略的理解</p>
<ul>
<li>DHCP客户机不知道内网中到底谁是DHCP服务机，于是想全网广播DHCP
Discover包，请求DHCP服务</li>
<li>DHCP服务机收到请求后向DHCP客户机发送一个可用的IP地址</li>
<li>客户端可能接受到很多服务机发来的很多IP，选择最早收到的那个IP(证明这个路线最快的)发送DHCP
Request包告诉服务器，这个IP我用了</li>
<li>服务器收到Request包后再次确认这个IP有没有被别的机器占用(可能在客户机回复的这个期间这个IP就被占用了)，如果没有占用回复DHCP
ACK包，代表可用，如果被占用了回复DHCP NAL包拒绝分配</li>
</ul>
<p>可以这样理解</p>
<ul>
<li>一个人(DHCP客户端)去找工作，先给整个行业发送简历面试(DHCP
Discover)</li>
<li>有公司看上了他，于是回复offer(DHCP offer)说可以来我们公司上班了</li>
<li>这个人收到了很多公司(DHCP服务器)的offer(DHCP
Offer)决定选择待遇最好(回复DHCPoffer最快的)的公司上班于是就回复Offer(DHCP
Request)说我去你们公司上班了</li>
<li>公司收到回复后再次确认这个offer是否有效，比如超时了？Offer发给别人了？然后回复</li>
</ul>
<p>详细的过程</p>
<ul>
<li>当DHCP客户机启动后，发现自己没有IP，于是将自己的IP设置为0.0.0.0，但是0.0.0.0不是合法IP无法通信，于是联系DHCP，联系方法就是向全网的UDP
67端口发送请求包，这个包里面包含了自己的MAC和主机名(方便后续确认)</li>
<li>DHCP收到主机名后在自己的可用IP池里找一个，做好标记，将自己的MAC与自己的IP，合法的IP合法的网关，子网掩码发回，由于不知道到底是谁发来的，于是仍然是以全网广播的形式发回，此时所有发送给DHCP请求的设备都会收包，但是由于有主机名与MAC可以校验是否正确收到</li>
<li>客户机收到OFFER后找到最先收到的，保留服务器的IP，向<strong>全网广播</strong>REQUEST，告诉全网DHCP服务器自己和那个服务器联系上了，相当于拒绝
了其他服务器，这个数据包包含了服务器IP，服务器表示字段</li>
<li>当DHCP服务器收到DHCP客户机回答的DHCP
request请求信息之后，它便向DHCP客户机发送一个包含它所提供的IP地址和其他设置的DHCP
ack确认信息，告诉DHCP客户机可以使用它所提供的IP地址。然后DHCP客户机便将其TCP/IP协议与网卡绑定，另外，除DHCP客户机选中的服务器外，其他的DHCP服务器都将收回曾提供的IP地址。</li>
<li>重新登录。以后DHCP客户机每次重新登录网络时，就不需要再发送DHCP
discover发现信息了，而是直接发送包含前一次所分配的IP地址的DHCP
request请求信息(因为已经保留了DHCP服务器地址)。当DHCP服务器收到这一信息后，它会尝试让DHCP客户机继续使用原来的IP地址，并回答一个DHCP
ack确认信息。如果此IP地址已无法再分配给原来的DHCP客户机使用时（比如此IP地址已分配给其它DHCP客户机使用），则DHCP服务器给DHCP客户机回答一个DHCP
nack否认信息。当原来的DHCP客户机收到此DHCP
nack否认信息后，它就必须重新发送DHCP
discover发现信息来请求新的IP地址。</li>
</ul>
<p><strong>DHCP的续租</strong></p>
<ul>
<li>默认租约与最长租约：默认租约指的是服务器租告诉客户机下次续租的时间，在这个时间内如果需要续约，客户机会联系服务机，如果一直联系不到服务机，客户机会在最长租约到期的时候自动退租</li>
<li>客户机会在租约过去50%的时候找DHCP服务器续租，方式就是发送DHCPRequest包，收到ACK包代表成功，客户机就会根据包内数据更新租期，调整参数，如果没有收到，客户机会继续使用剩下的50%</li>
<li>如果50%的时候没有收到ACK，客户机会在87.5%的时候再次请求续租，如果还是失败，到最长租期的时候客户机会自动放弃IP，重新广播请求</li>
</ul>
<h3 id="dhcp服务搭建">DHCP服务搭建</h3>
<p>环境准备：</p>
<ul>
<li>切换到VMware 使用CentOS7</li>
<li>关闭SELinux，关闭防火墙</li>
<li>关闭VMware网络编辑器的DHCP功能(编辑-虚拟网络编辑器-选择NAT和HostOnly-取消勾选DHCP)</li>
<li>准备两台机器开启网络连接设置NAT</li>
</ul>
<p>软件：</p>
<ul>
<li>dhcp：DHCP<strong>服务用</strong>软件包(<code>yum -y install dhcp</code>)</li>
<li>dhcp-common：DHCP软件命令包(BaseServer自带)</li>
</ul>
<p>服务：</p>
<ul>
<li>dhcpd：DHCP服务名</li>
<li>dhcrelay：DHCP中继服务</li>
</ul>
<p>端口号：</p>
<ul>
<li>udp 67：服务器监听端口，收用户的请求</li>
<li>udp 68：服务器源端口，发送数据包给用户</li>
</ul>
<p>配置文件：</p>
<ul>
<li>dhcpd的配置文件：/etc/dhcp/dhcpd.conf(这个文件默认空，只说了模板文件在哪里)与/usr/share/doc/dhcp-***/dhcpd.conf.sample(DHCP模板文件)</li>
<li>dhcrelay的配置文件：/etc/sysconfig/shcrelay</li>
</ul>
<p><strong>基础实验</strong></p>
<ul>
<li><p>生成配置文件：复制/usr/share/doc/dhcp-***/dhcpd.conf.sample到/etc/dhcp/dhcpd.conf</p></li>
<li><p>有很多</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">subnet <span class="token number">10.254</span>.239.32 netmask <span class="token number">255.255</span>.255.224 <span class="token punctuation">&#123;</span>
  range dynamic-bootp <span class="token number">10.254</span>.239.40 <span class="token number">10.254</span>.239.60<span class="token punctuation">;</span>
  option broadcast-address <span class="token number">10.254</span>.239.31<span class="token punctuation">;</span>
  option routers rtr-239-32-1.example.org<span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p><strong>subnet</strong>开头的代码块，全部注释，只保留最后一个，如下</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">subnet <span class="token number">10.5</span>.5.0 netmask <span class="token number">255.255</span>.255.224 <span class="token punctuation">&#123;</span>			<span class="token comment"># 分配网段 子网掩码</span>
  range <span class="token number">10.5</span>.5.26 <span class="token number">10.5</span>.5.30<span class="token punctuation">;</span>						<span class="token comment"># IP池</span>
  option domain-name-servers ns1.internal.example.org<span class="token punctuation">;</span>	<span class="token comment"># 主机所在域</span>
  option domain-name <span class="token string">"internal.example.org"</span><span class="token punctuation">;</span>		<span class="token comment"># 主机名</span>
  option routers <span class="token number">10.5</span>.5.1<span class="token punctuation">;</span>							<span class="token comment"># 默认网关</span>
  option broadcast-address <span class="token number">10.5</span>.5.31<span class="token punctuation">;</span>				<span class="token comment"># 广播地址</span>
  default-lease-time <span class="token number">600</span><span class="token punctuation">;</span>							<span class="token comment"># 租约</span>
  max-lease-time <span class="token number">7200</span><span class="token punctuation">;</span>								<span class="token comment"># 租约</span>
<span class="token punctuation">&#125;</span></code></pre>
<p>修改配置为</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">subnet <span class="token number">192.168</span>.46.0 netmask <span class="token number">255.255</span>.255.0 <span class="token punctuation">&#123;</span>
  range <span class="token number">192.168</span>.46.101 <span class="token number">192.168</span>.46.110<span class="token punctuation">;</span>
  default-lease-time <span class="token number">600</span><span class="token punctuation">;</span>
  max-lease-time <span class="token number">7200</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p><strong>注意</strong>：subnet要写DHCP服务器所在的<strong>网段</strong>，主机名写0！，使用<code>ip a</code>查询ip和掩码</p>
<p>启动</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">systemctl start dhcpd</code></pre>
<p>验证dhcp启动</p>
<pre class="language-shell" data-language="shell"><code class="language-shell"><span class="token punctuation">[</span>root@Cent7Base1 dhcp<span class="token punctuation">]</span><span class="token comment"># netstat -tlun</span>
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        <span class="token number">0</span>      <span class="token number">0</span> <span class="token number">0.0</span>.0.0:67              <span class="token number">0.0</span>.0.0:*                          </code></pre>
<p>看到UDP67端口已经启用,其他机器只要setup设置自动获取DHCP,然后重启服务(systemctl
)</p></li>
</ul>
<p>==DHCP服务无法关闭 实验略==</p>
<h2 id="dns服务">DNS服务</h2>
<p>DNS就是将域名与IP相互转换的服务，可以运行在公网上，域名-&gt;IP叫做正向解析，IP-&gt;域名叫做反向解析</p>
<h3 id="域名的组成与分类">域名的组成与分类</h3>
<p>常见格式：www.baidu.com 完整格式：www.baidu.com.
完整格式多了一个点，这个在早期是必写的，现在浏览器会自动补上，可以不写，完整域名自右向左分别是</p>
<ul>
<li><p><code>.</code>：根域，可以不写，所有的网站都是从根域出发的</p>
<p>世界上有一台主根服务器，和12个辅根服务器，主根服务器辅根服务器从主根服务器同步数据，但是国内没有IPv4的根服务器，有镜像根服务器可以从主根服务器中获取镜像</p></li>
<li><p><code>com</code>：顶级域，是由ICANN组织指定和管理，顶级域有</p>
<ul>
<li>国家地区域名：cn,jp,us...</li>
<li>通用顶级域名：org,edu,org...</li>
<li>新通用顶级域名：top，red...</li>
</ul></li>
<li><p><code>baidu</code>：二级域，是由个人去申请</p></li>
<li><p><code>www</code>：三级域，服务器网站域名</p></li>
<li><p>......</p></li>
</ul>
<h3 id="域名解析过程">域名解析过程</h3>
<p>以www.liukairui.cc为例</p>
<ul>
<li>输入域名(www.liukairui.cc)</li>
<li>浏览器补根域名和:80(www.liukairui.cc.:80)</li>
<li>本机查询Hosts文件本地的DNS(在hosts中找www.liukairui.cc.:80)</li>
<li>本机Hosts文件没有找到的话找本机的DNS缓存(在缓存中找www.liukairui.cc.:80)</li>
<li>没有的话访问DNS服务器获取IP地址(去问DNSwww.liukairui.cc.:80)</li>
<li>DNS服务器先在自己的解析库进行查找(去解析库中找www.liukairui.cc.:80)</li>
<li>找不到的话DNS去自己的缓存中找(缓存并不是指自己的最近查找的，而是从根服务器查找的，DNS认为这些可能不权威于是不入库)(去缓存中找www.liukairui.cc.:80)</li>
<li>找不到的话去找根服务器(问根服务器找www.liukairui.cc.:80)</li>
<li>根服务器识别网站的一级域，返回顶级域名服务器地址</li>
<li>DNS去找对应的顶级域服务器(DNS服务器去找.cc.的顶级域名服务器)</li>
<li>顶级域名服务器去找二级域名ip(cc顶级域名服务器去找liukairui.cc的ip，没有www.！)</li>
<li>DNS服务器去找网站问子域名IP(DNS问liukairui.cc问他www.liukairui.cc在哪里)</li>
<li>liukairui.cc返回www.liukairui.cc的IP</li>
</ul>
<h3 id="dns实验">DNS实验</h3>
<ul>
<li><p>软件名：bind</p></li>
<li><p>服务名：named</p></li>
<li><p>软件端口</p>
<p>UDP 53 监听端口，与客户机通信</p>
<p>TCP 53 服务器主从同步</p></li>
<li><p>配置文件</p>
<p><code>/etc/named.conf</code>
主配置文件<code>/etc/named.rfc1912.zones</code>正反向解析配置文件</p>
<p><code>/var/named/named.localhost</code>正向解析配置文件，<code>/var/named/named.loopback</code>反向解析配置文件</p></li>
<li><p>相关文件</p>
<p><code>/var/named/named.ca</code>记录了13台根域服务器位置</p>
<p><code>/var/named/slaves</code>主从同步缓存</p>
<p><code>/var/named/XX.XX</code>地址IP对应关系映射文件与主从同步文件</p></li>
<li><p>配置 所有大括号内部都有空格！！！</p>
<p><code>/etc/named.conf</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">options <span class="token punctuation">&#123;</span>
	listen-on port <span class="token number">53</span> <span class="token punctuation">&#123;</span> <span class="token number">127.0</span>.0.1<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>		<span class="token comment"># 监听网卡IP</span>
	listen-on-v6 port <span class="token number">53</span> <span class="token punctuation">&#123;</span> ::1<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>			<span class="token comment"># 监听网卡IP(IPv6)</span>
	<span class="token comment"># 此处的网卡指的是**服务器连接的网卡的IP**，意思是监听来自那张网卡的请求，接受所有网卡写any</span>
	directory 	<span class="token string">"/var/named"</span><span class="token punctuation">;</span>
	dump-file 	<span class="token string">"/var/named/data/cache_dump.db"</span><span class="token punctuation">;</span>
	statistics-file <span class="token string">"/var/named/data/named_stats.txt"</span><span class="token punctuation">;</span>
	memstatistics-file <span class="token string">"/var/named/data/named_mem_stats.txt"</span><span class="token punctuation">;</span>
	recursing-file  <span class="token string">"/var/named/data/named.recursing"</span><span class="token punctuation">;</span>
	secroots-file   <span class="token string">"/var/named/data/named.secroots"</span><span class="token punctuation">;</span>
	<span class="token comment"># 以上是数据文件保存目录</span>
	allow-query     <span class="token punctuation">&#123;</span> localhost<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
	<span class="token comment"># 允许访问服务器的客户端的IP，localhost就只有本机可以使用，改为any</span>
	recursion <span class="token function">yes</span><span class="token punctuation">;</span>
	dnssec-enable <span class="token function">yes</span><span class="token punctuation">;</span>
	dnssec-validation <span class="token function">yes</span><span class="token punctuation">;</span>
	bindkeys-file <span class="token string">"/etc/named.root.key"</span><span class="token punctuation">;</span>
	managed-keys-directory <span class="token string">"/var/named/dynamic"</span><span class="token punctuation">;</span>
	pid-file <span class="token string">"/run/named/named.pid"</span><span class="token punctuation">;</span>
	session-keyfile <span class="token string">"/run/named/session.key"</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
logging <span class="token punctuation">&#123;</span>
        channel default_debug <span class="token punctuation">&#123;</span>
                <span class="token function">file</span> <span class="token string">"data/named.run"</span><span class="token punctuation">;</span>
                severity dynamic<span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
zone <span class="token string">"."</span> IN <span class="token punctuation">&#123;</span>
	<span class="token builtin class-name">type</span> hint<span class="token punctuation">;</span>
	<span class="token function">file</span> <span class="token string">"named.ca"</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
include <span class="token string">"/etc/named.rfc1912.zones"</span><span class="token punctuation">;</span>			<span class="token comment"># 调用区域配置文件</span>
include <span class="token string">"/etc/named.root.key"</span><span class="token punctuation">;</span></code></pre>
<p>将<code>listen-on port</code>与allow-query改为any</p>
<p><code>/etc/named.rfc1912.zones</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">zone <span class="token string">"localhost.localdomain"</span> IN <span class="token punctuation">&#123;</span>	<span class="token comment"># 正向配置，写要解析的域名的*域*，例如swu.edu.cn写edu.cn</span>
        <span class="token builtin class-name">type</span> master<span class="token punctuation">;</span>				<span class="token comment"># 服务器类型：主(master)/从(slave)</span>
        <span class="token function">file</span> <span class="token string">"named.localhost"</span><span class="token punctuation">;</span>		<span class="token comment"># 正向配置文件位置</span>
        allow-update <span class="token punctuation">&#123;</span> none<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>		<span class="token comment"># 允许来自哪里IP从服务器从我这里同步数据库</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span>

zone <span class="token string">"1.0.0.127.in-addr.arpa"</span> IN <span class="token punctuation">&#123;</span>	
<span class="token comment"># 逆序填写IP(通常写的是网段,例如192.168.5.0写成0.5.168.192或者5.168.192)</span>
<span class="token comment"># .in-addr.arpa" IN是固定内容</span>
        <span class="token builtin class-name">type</span> master<span class="token punctuation">;</span>
        <span class="token function">file</span> <span class="token string">"named.loopback"</span><span class="token punctuation">;</span>
        allow-update <span class="token punctuation">&#123;</span> none<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span></code></pre>
<p>正向解析文件，XX.XX</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token variable">$TTL</span> 1D								<span class="token comment"># 域名有效解析生存周期</span>
@       IN SOA  @ rname.invalid. <span class="token punctuation">(</span>	
<span class="token comment"># @ 要替换为DNS服务器域名 IN SOA是起始授权机构资源记录，不动即可 rname.invalid.写解析域名的域，例如想解析cs.swu.edu.cn就写swu.edu.cn. 一般要在DNS域&amp;目标域后面加上根域.</span>
                                        <span class="token number">0</span>       <span class="token punctuation">;</span> serial
                                        <span class="token comment"># 配置文件的版本，例如20210320，用于同步的标识</span>
                                        1D      <span class="token punctuation">;</span> refresh
                                        <span class="token comment"># 从服务器多久同步一次</span>
                                        1H      <span class="token punctuation">;</span> retry
                                        <span class="token comment"># 主从同步失败后重试周期</span>
                                        1W      <span class="token punctuation">;</span> expire
                                        <span class="token comment"># 无法更新的时候从服务器*服务*的失效时间</span>
                                        3H <span class="token punctuation">)</span>    <span class="token punctuation">;</span> minimum
                                        <span class="token comment"># 缓存回答NO的失效时间</span>
        NS      @			<span class="token comment"># 这个网站自己的DNS服务器位置</span>
        A       <span class="token number">127.0</span>.0.1	<span class="token comment"># IPv4解析记录</span>
        AAAA    ::1			<span class="token comment"># IPv6解析记录</span></code></pre>
<p>反向解析文件，XX.XX</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token variable">$TTL</span> 1D
@       IN SOA  @ rname.invalid. <span class="token punctuation">(</span>
                                        <span class="token number">0</span>       <span class="token punctuation">;</span> serial
                                        1D      <span class="token punctuation">;</span> refresh
                                        1H      <span class="token punctuation">;</span> retry
                                        1W      <span class="token punctuation">;</span> expire
                                        3H <span class="token punctuation">)</span>    <span class="token punctuation">;</span> minimum
        NS      @
        A       <span class="token number">127.0</span>.0.1
        AAAA    ::1
        PTR     localhost.			<span class="token comment"># 反向解析记录</span></code></pre>
<p>常见记录类型</p>
<table>
<colgroup>
<col style="width: 7%" />
<col style="width: 92%" />
</colgroup>
<thead>
<tr class="header">
<th>类型</th>
<th>作用</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>A</td>
<td>IPv4地址记录</td>
</tr>
<tr class="even">
<td>CNAME</td>
<td>将公开的这个域名指向另一个不公开的域名的，但是浏览器还是现实公开的域名</td>
</tr>
<tr class="odd">
<td>TXT</td>
<td>任何东西，用来反垃圾邮件</td>
</tr>
<tr class="even">
<td>NS</td>
<td>这个域名的域的DNS，例如DNSPOD有swu.edu.cn的记录，阿里云有computer.swu.edu.cn的记录，那么就需要把DNSPOD的NS指向阿里云</td>
</tr>
<tr class="odd">
<td>AAAA</td>
<td>IPv6地址记录</td>
</tr>
<tr class="even">
<td>MX</td>
<td>邮件交换记录，让收件箱可以收到邮件就需要MX</td>
</tr>
</tbody>
</table></li>
<li><p><strong>基本功能实现</strong></p>
<p>使用两台服务器Cent7Base1(192.168.40.129)作为DNS服务器，Cent7Base2做Apache服务器(192.168.40.130)，Cent7Base3作为客户端</p>
<ul>
<li><p>配置主配置文件<code>/etc/named.conf</code></p>
<pre class="language-diff" data-language="diff"><code class="language-diff"><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> listen-on port 53 &#123; 127.0.0.1; &#125;;
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> listen-on port 53 &#123; any; &#125;;
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> listen-on-v6 port 53 &#123; ::1:; &#125;;
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> listen-on-v6 port 53 &#123; any; &#125;;
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> allow-query     &#123; localhost; &#125;;
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> allow-query     &#123; any; &#125;;</span></span></code></pre></li>
<li><p>配置区域配置文件<code>/etc/named.rfc1912.zones</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">zone <span class="token string">"mytest.com"</span> IN <span class="token punctuation">&#123;</span>					<span class="token comment"># 域名</span>
        <span class="token builtin class-name">type</span> master<span class="token punctuation">;</span>
        <span class="token function">file</span> <span class="token string">"mytest.localhost"</span><span class="token punctuation">;</span>		<span class="token comment"># 正向文件</span>
        allow-update <span class="token punctuation">&#123;</span> none<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span>

zone <span class="token string">"40.168.192.in-addr.arpa"</span> IN <span class="token punctuation">&#123;</span>		<span class="token comment"># 反写网段</span>
        <span class="token builtin class-name">type</span> master<span class="token punctuation">;</span>
        <span class="token function">file</span> <span class="token string">"mytest.loopback"</span><span class="token punctuation">;</span>			<span class="token comment"># 反向文件</span>
        allow-update <span class="token punctuation">&#123;</span> none<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span><span class="token punctuation">;</span></code></pre></li>
<li><p>数据文件<code>mytest.localhost</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token variable">$TTL</span> 1D
@       IN SOA  mytest.com. rname.invalid. <span class="token punctuation">(</span>
                                        <span class="token number">0</span>       <span class="token punctuation">;</span> serial
                                        1D      <span class="token punctuation">;</span> refresh
                                        1H      <span class="token punctuation">;</span> retry
                                        1W      <span class="token punctuation">;</span> expire
                                        3H <span class="token punctuation">)</span>    <span class="token punctuation">;</span> minimum
        NS      dns.mytest.com.
dns     A       <span class="token number">192.168</span>.40.129
www     A       <span class="token number">192.168</span>.40.130</code></pre></li>
<li><p>反向解析记录<code>mytest.loopback</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token variable">$TTL</span> 1D
@       IN SOA  mytest.com. rname.invalid. <span class="token punctuation">(</span>
                                        <span class="token number">0</span>       <span class="token punctuation">;</span> serial
                                        1D      <span class="token punctuation">;</span> refresh
                                        1H      <span class="token punctuation">;</span> retry
                                        1W      <span class="token punctuation">;</span> expire
                                        3H <span class="token punctuation">)</span>    <span class="token punctuation">;</span> minimum
        NS      dns.mytest.com.
<span class="token number">129</span>     PTR     dns.mytest.com.
<span class="token number">130</span>     PTR     www.mytest.com.</code></pre></li>
<li><p>启动与验证</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@Cent7Base1 named<span class="token punctuation">]</span><span class="token comment"># systemctl restart named</span>
<span class="token punctuation">[</span>root@Cent7Base1 named<span class="token punctuation">]</span><span class="token comment"># netstat -tuln</span>
Active Internet connections <span class="token punctuation">(</span>only servers<span class="token punctuation">)</span>
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        <span class="token number">0</span>      <span class="token number">0</span> <span class="token number">192.168</span>.40.129:53       <span class="token number">0.0</span>.0.0:*               LISTEN     
tcp        <span class="token number">0</span>      <span class="token number">0</span> <span class="token number">127.0</span>.0.1:53            <span class="token number">0.0</span>.0.0:*               LISTEN     
tcp6       <span class="token number">0</span>      <span class="token number">0</span> :::53                   :::*                    LISTEN     
udp        <span class="token number">0</span>      <span class="token number">0</span> <span class="token number">192.168</span>.40.129:53       <span class="token number">0.0</span>.0.0:*                          
udp        <span class="token number">0</span>      <span class="token number">0</span> <span class="token number">127.0</span>.0.1:53            <span class="token number">0.0</span>.0.0:*                          
udp6       <span class="token number">0</span>      <span class="token number">0</span> :::53                   :::*                               </code></pre>
<p>看到有三个TCP的53和三个UDP的53</p></li>
<li><p>使用DNS</p>
<p>nmtui找到网卡配置 设置DNS为192.168.40.129</p>
<p><code>systemctl restart network</code>重启网卡</p>
<p>nslookup www.mytest.com即可</p>
<p>注意，<code>systemctl restart network</code>会重启所有的网卡，这是不能出现在服务器上的，这样的重启会导致公网服务中断，正确的方式是单独重启对应的网卡，例如重启ens33：<code>ifdown ens33;ifup ens33</code>即可，先断点后通电</p>
<p>实际上，上面这个实验不会成功，因为互联网上真的有一个网站叫做www.mytest.com，IP是185.53.177.74在欧洲，于是你可能会解析到这个IP,因为vmware的首选DNS是外网的，只需要设置一个没人注册的域名就可以了，例如我试过<code>www.imkarryinswu.com</code>重新配置，顺利使用.</p></li>
</ul></li>
<li><p><strong>主从DNS服务器</strong></p>
<p>使用：四台服务器，VMC7B1(192.168.40.132)作主DNS服务器，VMC7B2(192.168.40.133)作从DNS服务器，VMC7B3(192.168.40.134)作http服务器，VMC6B1(192.168.40.135)做客户机</p>
<p>从服务器可以减轻主服务器压力，备份主服务器数据</p>
<p>主DNS连接到从DNS,客户机连接到从DNS</p>
<ul>
<li><p>配置VMC6B1,VMC7B3</p>
<p>开启http服务，设置DNS为192.168.40.133</p></li>
<li><p>配置主服务器VMC7B1(基于上一个实验的配置文件)</p>
<p>修改主配置文件<code>/etc/named.conf</code></p>
<pre class="language-diff" data-language="diff"><code class="language-diff"><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> listen-on port 53 &#123; any; &#125;;
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> listen-on port 53 &#123; 192.168.40.132; &#125;;		# DNS监听端口为本机的一个网卡，当然可以写any
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> allow-query     &#123; any; &#125;;
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> allow-query     &#123; 192.168.40.133; &#125;;			# 设置允许从服务器IP同步</span></span></code></pre>
<p>区域配置文件不变</p>
<p>修改正向解析配置文件<code>/var/named/imkarryinswu.localhost</code></p>
<pre class="language-diff" data-language="diff"><code class="language-diff">$TTL 1D
@       IN SOA  imkarryinswu.com. rname.invalid. (
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line">                                       0       ; serial
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line">                                       20210325; serial
</span></span><span class="token unchanged"><span class="token prefix unchanged"> </span><span class="token line">                                       1D      ; refresh
</span><span class="token prefix unchanged"> </span><span class="token line">                                       1H      ; retry
</span><span class="token prefix unchanged"> </span><span class="token line">                                       1W      ; expire
</span><span class="token prefix unchanged"> </span><span class="token line">                                       3H )    ; minimum
</span><span class="token prefix unchanged"> </span><span class="token line">       NS      dns.imkarryinswu.com.
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line">www     A       192.168.40.133
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line">www     A       192.168.40.134			# http服务器位置变动
</span></span>dns     A       192.168.40.132</code></pre>
<p>修改反向解析配置文件(同正向解析配置文件)</p></li>
<li><p>修改从服务器配置</p>
<p>修改主配置文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">listen-on port <span class="token number">53</span> <span class="token punctuation">&#123;</span> <span class="token number">192.168</span>.40.133<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
listen-on-v6 port <span class="token number">53</span> <span class="token punctuation">&#123;</span> ::1<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
allow-query     <span class="token punctuation">&#123;</span> any<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span></code></pre>
<p>修改从服务器区域配置</p>
<pre class="language-diff" data-language="diff"><code class="language-diff">zone "imkarryinswu.com" IN &#123;
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line">        type master;
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line">        type slave;				# 设置类型为从服务器
</span><span class="token prefix inserted">+</span><span class="token line">        masters &#123; 192.168.40.132; &#125;;	# 填写主服务器IP
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line">		 file "mytest.localhost";				
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line">        file "slaves/imkarryinswu.localhost";	# 文件保存位置,前面要加上slaves
</span><span class="token prefix inserted">+</span><span class="token line"> 		 # 注意:从服务器默认保存路径是/var/named/slaves这里最好也加上，否则保存到/var/named 
</span></span>&#125;;

zone "1.0.0.127.in-addr.arpa" IN &#123;		# 反向解析同理
<span class="token unchanged"><span class="token prefix unchanged"> </span><span class="token line">       type slave;
</span><span class="token prefix unchanged"> </span><span class="token line">       masters &#123; 192.168.40.132; &#125;;
</span><span class="token prefix unchanged"> </span><span class="token line">       file "slaves/imkarryinswu.loopback";
</span></span>&#125;;</code></pre></li>
<li><p>测试</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@VMC6B1 ~<span class="token punctuation">]</span><span class="token comment"># nslookup www.imkarryinswu.com</span>
Server:         <span class="token number">192.168</span>.40.133
Address:        <span class="token number">192.168</span>.40.133<span class="token comment">#53</span>

Name:   www.imkarryinswu.com
Address: <span class="token number">192.168</span>.40.134

<span class="token punctuation">[</span>root@VMC6B1 ~<span class="token punctuation">]</span><span class="token comment"># ping www.imkarryinswu.com</span>
PING www.imkarryinswu.com <span class="token punctuation">(</span><span class="token number">192.168</span>.40.134<span class="token punctuation">)</span> <span class="token number">56</span><span class="token punctuation">(</span><span class="token number">84</span><span class="token punctuation">)</span> bytes of data.
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.40.134: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">1</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">1.25</span> ms
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.40.134: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">2</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">0.472</span> ms</code></pre></li>
<li><p>尝试主服务器挂掉</p>
<p>主服务器</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">systemctl stop named</code></pre>
<p>可以正常使用</p></li>
</ul></li>
<li><p><strong>DNS缓存服务器</strong></p>
<p>主从服务器可以减少主服务器的压力，但是用户的查询时间并不会改变，我们希望搭建一个缓存服务器，将常用网站缓存起来，可以快速访问</p>
<p>原理：主从模式是从服务器定期主动的向主服务器更新自己的DNS信息，同时可以独立为其他用户提供服务，缓存服务器不会主动更新，只有当用户请求他解析IP后他会向主服务器要解析结果，同时自己保留一份，过期销毁，不会主动向主服务器更新，主服务器挂了之后如果还有请求会从自己的缓存从拿数据，同时提示这是不权威的结果</p>
<p>实验环境与主从相同，接着上次实验的结果，修改从DNS服务器为缓存服务器，关闭从服务器的named服务，yum安装程序：dnsmasq,</p>
<p>配置文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">domain</span><span class="token operator">=</span>imkarryinswu.com		<span class="token comment"># 要缓存的域，这里不写的话缓存服务器连解析都不解析</span>
<span class="token assign-left variable">server</span><span class="token operator">=</span><span class="token number">192.168</span>.40.132		<span class="token comment"># 主DNS位置</span>
cache-size<span class="token operator">=</span><span class="token number">15000</span>			<span class="token comment"># 最大缓存条数</span></code></pre>
<p>尝试访问</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@VMC6B1 ~<span class="token punctuation">]</span><span class="token comment"># nslookup www.imkarryinswu.com</span>
Server:         <span class="token number">192.168</span>.40.133
Address:        <span class="token number">192.168</span>.40.133<span class="token comment">#53</span>

Name:   www.imkarryinswu.com
Address: <span class="token number">192.168</span>.40.134</code></pre>
<p>关闭主服务器访问，尝试再次访问</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@VMC6B1 ~<span class="token punctuation">]</span><span class="token comment"># nslookup www.imkarryinswu.com</span>
Server:         <span class="token number">192.168</span>.40.133
Address:        <span class="token number">192.168</span>.40.133<span class="token comment">#53</span>

Non-authoritative answer:			<span class="token comment"># 提示这不是权威的解析结果</span>
Name:   www.imkarryinswu.com
Address: <span class="token number">192.168</span>.40.134</code></pre></li>
<li><p>智能DNS分离解析</p>
<p>可以根据用户来源的不同，将一个域名解析成不同的IP</p>
<p>实验设备：
VMC7B1(192.168.40.132)做DNS服务器，同时做网关，使用内外双网卡，VMC7B2(192.168.40.133)做http服务器使用内外双网卡，VMC7B3(192.168.40.134)做内网测试机，C7B1做外网测试机</p>
<p>==虚拟机双网卡配置失败 实验略==</p></li>
</ul>
<h2 id="vsftp服务">VSFTP服务</h2>
<h3 id="vsftp服务概述">VSFTP服务概述</h3>
<p>FTP是文件传输协议的简称，实现了在Internet上进行双向数据明文传输服务，具有一定的危险性，VSFTP是一个在Linux上的安全文件传输协议服务，值得注意的是，其仍然是明文传输</p>
<p>安全性：</p>
<ul>
<li>vsftp程序是由普通用户运行的，权限低，提高了安全性</li>
<li>任何需要高权限的行为都需要上层软件许可</li>
<li>vsftp自己实现了绝大多数的管理功能，这意味着其基本不需要系统提供额外的管理美丽</li>
<li>实现了chroot功能可以限制用户只能在家目录登陆(linux的chroot实现了修改用户根目录的功能，
但是这里的根目录指的是用户的家目录而不是/)</li>
</ul>
<p><strong>VSFTP的连接方式</strong></p>
<p>ftp存在两个端口，支持两种连接</p>
<ul>
<li><p>控制连接(持续连接)
使用tcp21端口连接到服务器用于用户收发FTP命令，用于测试服务器是否联通</p></li>
<li><p>数据连接(非持续连接)
使用tcp20端口连接到服务器用于上传和下载数据</p></li>
</ul>
<p><strong>VSFTP的工作模式</strong></p>
<ul>
<li><p>主动模式(port模式)</p>
<p>FTP开启21监听端口</p>
<p>客户端向服务器21口发送用户名密码与登陆请求</p>
<p>服务器21口向客户端发送登录成功消息</p>
<p>客户端随机开放一个端口，客户端的PORT命令会记下端口并向服务器发送端口名与需要的文件名</p>
<p>服务器20口连接到用户随机端口开始通信</p>
<p>连接方式简单，适合频繁连接，文件小的传输</p></li>
<li><p>被动模式(Passive模式)</p>
<p>FTP开启21监听端口</p>
<p>客户端向服务器21口发送用户名密码与登陆请求</p>
<p>服务器21口向客户端发送登录成功消息</p>
<p>客户端向服务器21发送PASV命令</p>
<p>服务器端接收命令后开放随机端口</p>
<p>服务器把开放的随机端口告诉客户端</p>
<p>客户端开放随机端口连接到服务端的随机端口</p>
<p>客户端连接到随机端口(这个端口就是被动模式下了tcp20口)</p>
<p><strong>注意</strong>，被动模式下随机端口可能会随机到服务器ban掉的端口，所以要设置防火墙</p></li>
<li><p>默认是主动模式，为了安全的使用服务器，建议修改到被动模式</p></li>
</ul>
<p><strong>VSFTP传输模式</strong></p>
<ul>
<li>Binary模式：不对数据做任何处理，直接0101原文传输过去，适合压缩文件，图片，可执行文件</li>
<li>ASCII模式：在进行纯文本传输的时候，判断目标操作系统，转换部分符号，例如,</li>
</ul>
<p>RH发行版的VSFTP默认是binary模式，在用户登陆ftp后输入ascii转换为ascii模式，输入bin转换为Binary模式</p>
<p><strong>软件信息</strong></p>
<p>服务器软件名：vsftp</p>
<p>服务器软件包名：vsftpd</p>
<p>服务器服务名：vsftpd</p>
<p>客户端软件：ftp</p>
<p>配置文件：<code>/etc/vsftpd/vsftpd.conf</code></p>
<h3 id="登录验证方式">登录验证方式</h3>
<ul>
<li><p>匿名用户验证</p>
<p>帐户名：ftp/anonymous</p>
<p>密码：空</p>
<p>工作目录：<code>/var/ftp</code>(所有用户，不论是否匿名都在这里，建议每一个匿名登陆的用户单独设置工作目录)</p>
<p>默认权限：默认可以下载不可上传，想要上传需要修改主配置文件和文件系统(rwx权限)</p></li>
<li><p>本地用户验证</p>
<p>为了和Linux深度融合，vsftp使用了Linux的passwd和shadow存储了用户名和密码，于是我们很难分辨某个用户到底是ftp用户还是Linux用户，于是ftp的默认登陆位置就是帐户的家目录,登陆的时候就相当于是对应的用户登陆，所以所有的文件最大权限就是<code>drwx------</code></p>
<p>如果不希望让一个ftp帐号登陆Linux可以在创建用户的时候设置<code>useradd -s /sbin/nologin &lt;username&gt;</code>
-s是指定用户登陆的终端，我们将终端从默认是bash修改为了nologin这个不可登陆终端就可以了,当然还可以加一个<code>-r</code>创建系统用户，但是可能会返回<code>530 Login incorrect.</code>，这是因为<code>/etc/shells</code>下没有加入nologin，系统上合法的
shell 写入在/etc/shells 文件，只需要/etc/shells
写入<code>/sbin/nologin</code>即可</p></li>
<li><p>虚拟用户验证机制</p>
<p>我们可以创建虚拟用户来代替本地用户减少本地用户被连接</p>
<p>可以使用本地用户作为虚拟用户的映射用户并提供工作目录与权限管理</p>
<p>可以单独配置文件管理每一个帐户的权限</p>
<p>我们可以看到<code>/etc/vsftpd/vsftpd.conf</code>的<code>local_umask=022</code>所有本地用户登陆后都会受到这个umask权限的管理，无法为每个用户单独管理权限</p>
<p>我们可以将虚拟用户映射到本地用户，但是虚拟用户没有家，我们将映射到的本地用户的home做为他的默认根目录，本地用户为虚拟用户提供权限管理</p></li>
</ul>
<h3 id="使用ftp">使用FTP</h3>
<ul>
<li><code>ftp 地址</code>登录</li>
<li><code>?</code>查询所有可用命令</li>
<li><code>ls</code>,<code>cd</code>,<code>put</code>,<code>get</code>与sftp完全相同</li>
<li><code>mput</code>,<code>mget</code>同时上传或下载多文件</li>
<li><code>rename</code>重命名</li>
<li><code>delete</code>删除文件</li>
<li><code>rmdir</code>删除目录</li>
</ul>
<h3 id="普通实验">普通实验</h3>
<p>==vsftpd的配置文件：注释必须另起一行，行尾不留空格!!!==</p>
<ul>
<li><p><strong>匿名用户的登陆</strong></p>
<p>权限控制介绍</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">anonymous_enable</span><span class="token operator">=</span>YES			<span class="token comment"># 启用匿名访问</span>
<span class="token assign-left variable">anon_umask</span><span class="token operator">=</span>022					<span class="token comment"># 匿名用户上传文件的umask,默认匿名上传的匿名无法下载</span>
<span class="token assign-left variable">anon_root</span><span class="token operator">=</span>/var/ftp				<span class="token comment"># 匿名用户的FTP根目录</span>
<span class="token assign-left variable">anon_upload_enable</span><span class="token operator">=</span>YES			<span class="token comment"># 允许上传文件</span>
<span class="token assign-left variable">anon_mkdir_write_enable</span><span class="token operator">=</span>YES		<span class="token comment"># 允许匿名用户创建目录</span>
<span class="token assign-left variable">anon_other_write_enable</span><span class="token operator">=</span>YES		<span class="token comment"># 允许匿名用户其他写权限(删除/覆盖/重命名)</span>
<span class="token assign-left variable">anon_max_rate</span><span class="token operator">=</span><span class="token number">0</span>					<span class="token comment"># 允许匿名用户写入最大速率,0是不限速</span></code></pre>
<p><strong>设置客户端可以上传</strong></p>
<p>首先明确，匿名用户是映射到了本地用户<strong>显示的是</strong>ftp，对应的权限是ftp的权限，如果文件夹所有者是root那么权限就是其他人，如果文件是自己建立的，对应权限是所有者</p>
<p>找到<code>/etc/vsftpd/vsftpd.conf</code>，设置<code>anon_upload_enable=YES</code></p>
<p>修改/var/ftp文件系统权限，注意，默认/var/ftp权限是755,不要动，也不要动pub，如果设置为777，给的权限太高，vsftpd故意不让上传,提示<code>500 OOPS: vsftpd: refusing to run with writable root inside chroot()</code>。我们可以在ftp下新建一个目录，设置权限757,这样就可以自由使用了</p>
<p><strong>设置允许下载匿名上传的文件</strong></p>
<p>我们尝试下载一个上传的文件，但是提示<code>550 Failed to open file.</code>查看文件权限<code>-rw------- 1 ftp  ftp  197719 3月  26 17:33 icon</code>，这里需要修改权限给其他人r的权限，原因见下：主配置文件<code>anon_umask=022</code>即可，重启服务器,重新上传文件看到<code>-rw-r--r-- 1 ftp ftp 197719 3月  26 18:09 test</code></p>
<p><strong>允许匿名用户创建目录等操作</strong></p>
<p>修改主文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">anon_mkdir_write_enable</span><span class="token operator">=</span>YES		<span class="token comment"># 允许匿名用户创建目录</span>
<span class="token assign-left variable">anon_other_write_enable</span><span class="token operator">=</span>YES		<span class="token comment"># 允许匿名用户其他写权限(删除/覆盖/重命名)</span></code></pre></li>
<li><p><strong>设置用户进入文件夹后弹出说明</strong></p>
<p>在需要提示的目录下创建.message文件，设置主配置文件<code>dirmessage_enable=YES</code>,每次登陆后进入文件夹只提示一次</p></li>
<li><p><strong>匿名用户的映射用户问题</strong></p>
<ul>
<li><p>首先明确：<strong>匿名用户就是映射到了本地的ftp用户</strong></p></li>
<li><p>为什么不能在/var/ftp上传文件</p>
<p>这个文件夹是属于root的，ftp相对他是其他人，想要上传，思路当然是修改其他人的w权限，但是vsftpd不让设置其他人w权限，否则报错，所以去子目录上传文件即可</p></li>
<li><p>我创建一个文件夹，设置007权限，为什么ftp没法上传，至少要给707才可以</p>
<p>首先看看vsftpd跑在哪个用户上</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">ps</span> aux <span class="token operator">|</span> <span class="token function">grep</span> vsftpd
root      <span class="token number">1628</span>  <span class="token number">0.0</span>  <span class="token number">0.0</span>  <span class="token number">53288</span>   <span class="token number">580</span> ?        Ss   <span class="token number">11</span>:42   <span class="token number">0</span>:00 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf
root      <span class="token number">1667</span>  <span class="token number">0.0</span>  <span class="token number">0.0</span> <span class="token number">112824</span>   <span class="token number">980</span> pts/0    S+   <span class="token number">11</span>:44   <span class="token number">0</span>:00 <span class="token function">grep</span> --color<span class="token operator">=</span>auto vsftpd</code></pre>
<p>vsftpd是跑在root上的，不管怎么说，你要让root可以进去目录吧，你还要ftp用户可以进入目录吧，创建文件夹默认是root:root，你给007，ftp完全访问，root完全没法看，上传失败，所以至少是707。当然，可以验证，有两个方法</p>
<p>第一种：<code>chown ftp:ftp /var/ftp/XXX</code>然后不用改权限了，705正常使用</p>
<p>第二种：<code>chown liukairui:liukairui /var/ftp/XXX</code>,<code>chmod 007 /var/ftp/XXX</code>我随便换了个所有者，root和ftp都是其他人了，正常使用</p></li>
<li><p>为什么匿名用户上传无法下载，需要将文件设置为755才可以，700不可以</p>
<p>下载文件需要的只是r权限，在本地访问一个文件的话只要访问者有r就可以了，但是这是在ftp上，因为500的权限，所有者是ftp，root没法看文件，vsftpd是在root上的，vsftp也就无法看文件，所以没法下载，权限至少需要505，可以验证</p>
<p><code>chown liukairui:liukairui /var/ftp/XXX/XXX</code>,<code>chmod 005 /var/ftp/XXX/XXX</code>我随便换了个所有者，root和ftp都是其他人了，正常使用</p></li>
</ul></li>
<li><p><strong>本地用户实验</strong></p>
<p>一般本地用户的设置是以<code>local</code>开头的</p>
<p>匿名用户中没有提到的有</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">chroot_local_user</span><span class="token operator">=</span>YES 		<span class="token comment"># 是否将用户禁锢在根目录(默认用户登陆后是可以出家目录的,这意味着计算机中有r权限下的文件都可以下载)</span>
<span class="token assign-left variable">ftpd_banner</span><span class="token operator">=</span>XXX				<span class="token comment"># 用户登陆</span>
<span class="token assign-left variable">userlist_enable</span><span class="token operator">=</span>YES			
<span class="token assign-left variable">userlist_deny</span><span class="token operator">=</span>NO			<span class="token comment"># 黑白名单，deny是YES那么/etc/vsftpd/user_list中的用户禁止登陆，如果deny=NO,enable=YES，只允许名单中人登陆</span>
/etc/vsftpd/ftpusers文件	   <span class="token comment"># 最高优先级黑名单，设置后userlist_enable/deny对该用户设置值无效，立即生效</span></code></pre>
<p>创建本地用户并设置密码</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># useradd -r -s /sbin/nologin ftptest</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># passwd ftptest</span></code></pre>
<p><strong>将用户禁锢在家</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token comment"># (Warning! chroot'ing can be very dangerous. If using chroot, make sure that</span>
<span class="token comment"># the user does not have write access to the top level directory within the</span>
<span class="token comment"># chroot)</span>
<span class="token assign-left variable">chroot_local_user</span><span class="token operator">=</span>YES</code></pre>
<p>但是登陆失败了</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token number">500</span> OOPS: vsftpd: refusing to run with writable root inside chroot<span class="token punctuation">(</span><span class="token punctuation">)</span></code></pre>
<p>user1登陆后映射的当然是user1，需要关闭user1的写权限才可以</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">chmod</span> <span class="token number">500</span> user1</code></pre>
<p>无法出去了</p>
<p>如果不想修改家目录的权限也可以在主配置文件下<code>allow_writeable_chroot=YES</code></p>
<p><strong>允许部分用户设置可以访问家目录外</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">chroot_list_enable</span><span class="token operator">=</span>YES
<span class="token assign-left variable">chroot_list_file</span><span class="token operator">=</span>/etc/vsftpd/chroot_list</code></pre>
<p>/etc/vsftpd/chroot_list直接一行一行写用户名就可以了</p>
<p><strong>修改被动模式的数据传输端口</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">pasv_enable</span><span class="token operator">=</span>YES
<span class="token assign-left variable">pasv_min_port</span><span class="token operator">=</span><span class="token number">30000</span>
<span class="token assign-left variable">pasv_max_port</span><span class="token operator">=</span><span class="token number">35000</span></code></pre></li>
<li><p><strong>虚拟用户实验</strong></p>
<p><strong>关于PAM</strong></p>
<p>PAM(Pluggable Authentication
Modules)即可插拔式认证模块，它是一种高效而且灵活便利的用户级别的认证方式，它也是当前Linux服务器普遍使用的认证方式。当然，在不同版本的Linux统中部署PAM认证是有所不同的。
PAM认证一般遵循这样的顺序：Service(服务)→PAM(配置文件)→pam_*.so。PAM认证首先要确定那一项服务，然后加载相应的PAM的配置文件(位于/etc/pam.d下)，最后调用认证文件(位于/lib/security下)进行安全认证。</p>
<p>四种常见认证类型(module type)：</p>
<ol type="1">
<li><p>认证管理（authentication
management）接受用户名和密码，进而对该用户的密码进行认证，并负责设置用户的一些秘密信息。</p></li>
<li><p>帐户管理（account
management）检查帐户是否被允许登录系统，帐号是否已经过期，帐号的登录是否有时间段的限制等等。</p></li>
<li><p>密码管理（password
management）主要是用来修改用户的密码。</p></li>
<li><p>会话管理（session
management）主要是提供对会话的管理和记账（accounting）。</p></li>
</ol>
<p>验证控制类型也可以称做Control
Flags，用于PAM验证类型的返回结果，具体有以下四种：</p>
<ol type="1">
<li><p>required验证失败时仍然继续，但返回Fail(用户不会知道哪里失败)。</p></li>
<li><p>requisite验证失败则立即结束整个验证过程，返回Fail。</p></li>
<li><p>sufficient验证成功则立即返回，不再继续，否则忽略结果并继续。</p></li>
<li><p>optional无论验证结果如何，均不会影响(通常用于session类型)。</p></li>
</ol>
<p><strong>创建用户密码文件</strong></p>
<p>随便创建一个文件(例如vsftpd.user)，一行写用户名一行写密码</p>
<p>将明文用户名密码转换为数据库文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">db_load -T -t <span class="token builtin class-name">hash</span> -f vsftpd.user vsftpd.db
<span class="token function">chmod</span> <span class="token number">600</span> vsftpd.db 					<span class="token comment"># 保证安全性，不是600vsftp会报错</span></code></pre>
<ul>
<li><p><code>-T</code>普通文件转数据库文件</p></li>
<li><p><code>-t</code>加密类型</p></li>
<li><p><code>-f</code>源文件</p></li>
</ul>
<p><strong>创建虚拟映射用户</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">useradd</span> -d /var/virroot/ -s /sbin/nologin virtual</code></pre>
<p><strong>修改PAM配置</strong></p>
<p><code>/etc/pam.d/vsftpd.pam</code>[新文件]</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">auth    required        pam_userdb.so   <span class="token assign-left variable">db</span><span class="token operator">=</span>/etc/vsftpd/vsftpd
account required        pam_userdb.so   <span class="token assign-left variable">db</span><span class="token operator">=</span>/etc/vsftpd/vsftpd</code></pre>
<p>这里db不用写扩展名，会自动添加</p>
<p>此时vsftpd是不会主动找他的，vsftp的验证原理是：vsftpd调用PAM调用/etc/pam.d/vsftpd去检索passwd和shadow，我们需要修改主配置文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">pam_service_name</span><span class="token operator">=</span>vsftpd.pam			<span class="token comment"># 将vsftp换成vsftpd.pam验证配置</span>
<span class="token assign-left variable">guest_enable</span><span class="token operator">=</span>YES					<span class="token comment"># 允许虚拟用户</span>
<span class="token assign-left variable">guest_username</span><span class="token operator">=</span>virtual				<span class="token comment"># 虚拟用户的映射用户名</span>
<span class="token assign-left variable">user_config_dir</span><span class="token operator">=</span>/etc/vsftpd/dir		<span class="token comment"># 虚拟用户配置文件地址 创建dir目录存储配置文件</span></code></pre>
<p>还需要关闭所有非默认的匿名用户设置(换而言之只保留这两个)，原因是虚拟用户和匿名用户设置的key都是anon_XXX，如果主配置文件设置了，分配置文件的同名key就不会生效了！</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">anonymous_enable</span><span class="token operator">=</span>YES
<span class="token assign-left variable">anon_umask</span><span class="token operator">=</span>022</code></pre>
<p>在dir(或者自己的制定目录下)创建与虚拟用户同名文件，写入配置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">anon_upload_enable</span><span class="token operator">=</span>YES
<span class="token assign-left variable">anon_mkdir_write_enable</span><span class="token operator">=</span>YES
<span class="token assign-left variable">anon_upload_enable</span><span class="token operator">=</span>YES
<span class="token assign-left variable">anon_other_write_enable</span><span class="token operator">=</span>YES</code></pre>
<p>这里用的还是anon开头的</p>
<p>这个时候匿名用户配置失效了，在dir下创建ftp的配置文件也没用...</p>
<p>此时，我们的本地用户也失效了，原因很简单，pam文件路径改为了vsftpd.pam，原来查找passwd的vsftp没指到，解决方法很简单，复制vsftpd的内容到vsftpd.pam</p></li>
</ul>
<h3 id="opensslvsftp加密验证">openSSL+vsftp加密验证</h3>
<p>ftp是明文传输的，所以很轻松就可以实现抓包</p>
<p><strong>尝试使用tcpdump进行</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">tcpdump -i eth0 -nn -X -vv tcp port <span class="token number">21</span> and <span class="token function">ip</span> <span class="token function">host</span> <span class="token number">192.168</span>.5.162</code></pre>
<ul>
<li><code>-i</code>选择网卡</li>
<li><code>-n</code>显示主机地址而不是IP</li>
<li><code>-nn</code>显示端口号而不是端口服务名</li>
<li><code>-X</code>输出头部数据包以ASCII和16进制显示</li>
<li><code>-vv</code>详细输出</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token number">13</span>:53:32.546131 IP <span class="token punctuation">(</span>tos 0x10, ttl <span class="token number">64</span>, <span class="token function">id</span> <span class="token number">49814</span>, offset <span class="token number">0</span>, flags <span class="token punctuation">[</span>DF<span class="token punctuation">]</span>, proto TCP <span class="token punctuation">(</span><span class="token number">6</span><span class="token punctuation">)</span>, length <span class="token number">68</span><span class="token punctuation">)</span>
    <span class="token number">192.168</span>.5.162.48210 <span class="token operator">></span> <span class="token number">192.168</span>.5.175.21: Flags <span class="token punctuation">[</span>P.<span class="token punctuation">]</span>, <span class="token function">cksum</span> 0x2ffa <span class="token punctuation">(</span>correct<span class="token punctuation">)</span>, <span class="token function">seq</span> <span class="token number">2451149089</span>:2451149105, ack <span class="token number">3588930966</span>, win <span class="token number">502</span>, options <span class="token punctuation">[</span>nop,nop,TS val <span class="token number">3505103341</span> ecr <span class="token number">21779707</span><span class="token punctuation">]</span>, length <span class="token number">16</span>: FTP, length: <span class="token number">16</span>
        <span class="token environment constant">USER</span> liukairui
        0x0000:  <span class="token number">4510</span> 0044 c296 <span class="token number">4000</span> <span class="token number">4006</span> eb6b c0a8 05a2  E<span class="token punctuation">..</span>D<span class="token punctuation">..</span>@.@<span class="token punctuation">..</span>k<span class="token punctuation">..</span><span class="token punctuation">..</span>
        0x0010:  c0a8 05af bc52 0015 <span class="token number">9219</span> <span class="token number">9121</span> d5ea bd96  <span class="token punctuation">..</span><span class="token punctuation">..</span>.R<span class="token punctuation">..</span><span class="token punctuation">..</span>.<span class="token operator">!</span><span class="token punctuation">..</span><span class="token punctuation">..</span>
        0x0020:  <span class="token number">8018</span> 01f6 2ffa 0000 0101 080a d0eb a1ed  <span class="token punctuation">..</span><span class="token punctuation">..</span>/<span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span>.
        0x0030:  014c 54fb <span class="token number">5553</span> <span class="token number">4552</span> 206c <span class="token number">6975</span> 6b61 <span class="token number">6972</span>  .LT.<span class="token environment constant">USER</span>.liukair
        0x0040:  <span class="token number">7569</span> 0d0a                                ui<span class="token punctuation">..</span>

<span class="token number">13</span>:53:36.002522 IP <span class="token punctuation">(</span>tos 0x10, ttl <span class="token number">64</span>, <span class="token function">id</span> <span class="token number">49816</span>, offset <span class="token number">0</span>, flags <span class="token punctuation">[</span>DF<span class="token punctuation">]</span>, proto TCP <span class="token punctuation">(</span><span class="token number">6</span><span class="token punctuation">)</span>, length <span class="token number">66</span><span class="token punctuation">)</span>
    <span class="token number">192.168</span>.5.162.48210 <span class="token operator">></span> <span class="token number">192.168</span>.5.175.21: Flags <span class="token punctuation">[</span>P.<span class="token punctuation">]</span>, <span class="token function">cksum</span> 0xcceb <span class="token punctuation">(</span>correct<span class="token punctuation">)</span>, <span class="token function">seq</span> <span class="token number">16</span>:30, ack <span class="token number">35</span>, win <span class="token number">502</span>, options <span class="token punctuation">[</span>nop,nop,TS val <span class="token number">3505106796</span> ecr <span class="token number">21793097</span><span class="token punctuation">]</span>, length <span class="token number">14</span>: FTP, length: <span class="token number">14</span>
        PASS lkrXXXX
        0x0000:  <span class="token number">4510</span> 0042 c298 <span class="token number">4000</span> <span class="token number">4006</span> eb6b c0a8 05a2  E<span class="token punctuation">..</span>B<span class="token punctuation">..</span>@.@<span class="token punctuation">..</span>k<span class="token punctuation">..</span><span class="token punctuation">..</span>
        0x0010:  c0a8 05af bc52 0015 <span class="token number">9219</span> <span class="token number">9131</span> d5ea bdb8  <span class="token punctuation">..</span><span class="token punctuation">..</span>.R<span class="token punctuation">..</span><span class="token punctuation">..</span>.1<span class="token punctuation">..</span><span class="token punctuation">..</span>
        0x0020:  <span class="token number">8018</span> 01f6 cceb 0000 0101 080a d0eb af6c  <span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span><span class="token punctuation">..</span>.l
        0x0030:  014c <span class="token number">8949</span> <span class="token number">5041</span> <span class="token number">5353</span> 206c 6b72 <span class="token number">3031</span> <span class="token number">3031</span>  .L.IPASS.lkrXXXX
        0x0040:  0d0a    </code></pre>
<p><strong>SSL原理</strong></p>
<p>一次连接需要三个设备：CA证书服务器，服务器，客户端</p>
<p>CA证书服务器提供三个文件，密钥(.key文件)，相当于SSH的私钥，证书(.csr文件)，相当于SSH的公钥，签字后的证书(.crt文件)，是由证书转化而成，在证书的基础上具有一定有效期，有加密类型，有加密长度，CA服务器发布证书，同时有验证证书权威性的功能，证书颁布给服务器，用户访问网站的时候获取证书加密发送，相当于是一种密钥不从服务器产生的SSH，SSL+http得到https，SSL+ftp得到ftp
over TLS</p>
<p>服务器向证书颁发机构申请SSL,证书颁发机构记录服务器地理位置，公司名等信息后生成证书发回，此时CA服务器和服务器没有关系了，客户端登陆FTP后服务端发送证书，加密传输</p>
<p><strong>准备</strong></p>
<ul>
<li>检查是否安装了SSL</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">rpm</span> -q openssl</code></pre>
<ul>
<li>查看vsftpd是否支持openSSL</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash">ldd /usr/sbin/vsftpd <span class="token operator">|</span> <span class="token function">grep</span> libssl</code></pre>
<p>ldd用来显示共享库的依赖情况</p>
<ul>
<li><p>生成密钥和证书文件</p>
<p>我们将ftp服务器作为CA服务器</p>
<p>切换目录到<code>/etc/ssl/certs/</code></p>
<p>生成RSA密钥</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">openssl genrsa -out vsftpd.key <span class="token number">1024</span></code></pre>
<p>通过密钥生成证书</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 certs<span class="token punctuation">]</span><span class="token comment"># openssl req -new -key vsftpd.key -out vsftpd.csr</span>
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter <span class="token string">'.'</span>, the field will be left blank.
-----
Country Name <span class="token punctuation">(</span><span class="token number">2</span> letter code<span class="token punctuation">)</span> <span class="token punctuation">[</span>XX<span class="token punctuation">]</span>:CN			<span class="token comment"># 输入国家</span>
State or Province Name <span class="token punctuation">(</span>full name<span class="token punctuation">)</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>:CQ    	<span class="token comment"># 省份</span>
Locality Name <span class="token punctuation">(</span>eg, city<span class="token punctuation">)</span> <span class="token punctuation">[</span>Default City<span class="token punctuation">]</span>:CQ		<span class="token comment"># 城市</span>
Organization Name <span class="token punctuation">(</span>eg, company<span class="token punctuation">)</span> <span class="token punctuation">[</span>Default Company Ltd<span class="token punctuation">]</span>:test company		<span class="token comment"># 公司名</span>
Organizational Unit Name <span class="token punctuation">(</span>eg, section<span class="token punctuation">)</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>:test partmant					<span class="token comment"># 组织/部门</span>
Common Name <span class="token punctuation">(</span>eg, your name or your server<span class="token string">'s hostname) []:www.1.com		# 域名
Email Address []:1@a.com						# 邮箱

Please enter the following '</span>extra' attributes	<span class="token comment"># 是否要生成而外的密码</span>
<span class="token comment"># 这里不要生成额外的密码，否则以后获取证书的时候都要先解密</span>
to be sent with your certificate request
A challenge password <span class="token punctuation">[</span><span class="token punctuation">]</span>:						<span class="token comment"># 直接回车跳过</span>
An optional company name <span class="token punctuation">[</span><span class="token punctuation">]</span>:</code></pre>
<p>通过证书文件发布签名证书</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 certs<span class="token punctuation">]</span><span class="token comment"># openssl x509 -req -days 365 -sha256 -in vsftpd.csr -signkey vsftpd.key -out vsftpd.crt</span></code></pre>
<p><code>x509</code>：颁发格式</p>
<p>修改文件夹权限500</p></li>
<li><p>修改主配置文件使vsftpd可以识别证书，调用证书，设置哪个帐户可以使用证书</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">ssl_enable</span><span class="token operator">=</span>YES						<span class="token comment"># 开启SSL</span>
<span class="token assign-left variable">ssl_tlsv1</span><span class="token operator">=</span>YES						<span class="token comment"># 支持SSL的三个版本</span>
<span class="token assign-left variable">ssl_sslv2</span><span class="token operator">=</span>YES
<span class="token assign-left variable">ssl_sslv3</span><span class="token operator">=</span>YES
<span class="token assign-left variable">allow_anon_ssl</span><span class="token operator">=</span>YES					<span class="token comment"># 允许匿名与虚拟用户使用SSL</span>
<span class="token assign-left variable">force_anon_logins_ssl</span><span class="token operator">=</span>YES			<span class="token comment"># 强制匿名与虚拟用户使用SSL登陆	</span>
<span class="token assign-left variable">force_anon_data_ssl</span><span class="token operator">=</span>YES				<span class="token comment"># 强制匿名与虚拟用户使用SSL传输文件</span>
<span class="token assign-left variable">force_local_logins_ssl</span><span class="token operator">=</span>YES			<span class="token comment"># 强制本地用户SSL登陆</span>
<span class="token assign-left variable">force_local_data_ssl</span><span class="token operator">=</span>YES			<span class="token comment"># 强制本地用户SSL文件传输</span>
<span class="token assign-left variable">rsa_cert_file</span><span class="token operator">=</span>/etc/ssl/certs/vsftpd.crt			<span class="token comment"># SSL证书地址</span>
<span class="token assign-left variable">rsa_private_key_file</span><span class="token operator">=</span>/etc/ssl/certs/vsftpd.key	<span class="token comment"># SSL密钥地址</span></code></pre></li>
<li><p>尝试登陆</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">❯ <span class="token function">ftp</span> <span class="token number">192.168</span>.5.175
Connected to <span class="token number">192.168</span>.5.175.
<span class="token number">220</span> <span class="token punctuation">(</span>vsFTPd <span class="token number">3.0</span>.2<span class="token punctuation">)</span>
Name <span class="token punctuation">(</span><span class="token number">192.168</span>.5.175:liukairui<span class="token punctuation">)</span>: <span class="token function">ftp</span>
<span class="token number">530</span> Anonymous sessions must use encryption.
ftp: Login failed.
<span class="token number">421</span> Service not available, remote server has closed connection
ftp<span class="token operator">></span> </code></pre>
<p>使用filezilla</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">状态:	正在连接 <span class="token number">192.168</span>.5.175:21<span class="token punctuation">..</span>.
状态:	连接建立，等待欢迎消息<span class="token punctuation">..</span>.
状态:	初始化 TLS 中<span class="token punctuation">..</span>.
状态:	正在验证证书<span class="token punctuation">..</span>.
状态:	TLS 连接已建立。
状态:	已登录
状态:	读取目录列表<span class="token punctuation">..</span>.
状态:	列出“/”的目录成功</code></pre></li>
</ul>
<h2 id="samba服务">SAMBA服务</h2>
<h3 id="samba概述">Samba概述</h3>
<p>简称SMB(Server Message
Block)信息服务块，是一种在<strong>局域网</strong>进行<strong>文件与打印设备</strong>共享的通信协议，<strong>跨平台</strong>，C/S模式</p>
<p><strong>与FTP对比</strong></p>
<ul>
<li>FTP：可以进行文件传输，跨平台，工作在应用层，但是无法实现文件系统挂载(将某一个远程ftp文件夹挂在客户机上当成本地目录直接使用)，无法直接修改ftp上的文件，只能下载后上传，但是传输效率高于smb</li>
<li>Samba：使用smb/cifs协议，可以实现跨平台文件共享，支持远程挂载，支持远程修改文件</li>
</ul>
<p><strong>smb协议和cifs协议</strong></p>
<p>cifs是改进smb的协议，目前由微软管理。在很久以前，没有这种支持文件系统挂载与远程修改的协议，有人整理了一份这样的协议，后由微软整理重命名为cifs,并实现了互联网上的文件共享，并逐渐将其演化成了一种<strong>互联网</strong>文件系统</p>
<p>Samba软件信息</p>
<ul>
<li><p>协议：SMB/CIFS</p></li>
<li><p>软件包名：samba</p></li>
<li><p>服务名：smb</p>
<p>TCP 139</p>
<p>TCP 445</p></li>
<li><p>主配置文件：<code>/etc/samba/smb.conf</code></p>
<p>别名配置文件：<code>/etc/samba/smbusers</code></p></li>
</ul>
<h3 id="登录验证模式">登录验证模式</h3>
<ul>
<li>share匿名用户登录：与vsftp不同的是这个匿名登陆连用户名都不需要</li>
<li>user本地用户验证模式：与vsftpd的本地模式类似，这是与服务端进行交互的时候需要默认的验证模式，但是他没有使用PAM验证，而是使用了tdbsam方式进行验证，他会建立passdb.tdb用来存储<strong>密码</strong>,
什么意思，之前vsftpd使用了PAM，vsftp调用PAM的时候调用了<code>/etc/passwd</code>和<code>/etc/shadow</code>，但是tdbsam只调用了<code>/etc/passwd</code>而密码是通过自建数据库<code>passdb.tdb</code>来验证的，也就是说，<strong>一个用户是smaba用户的前提是他是一个Linux用户，否则压根没法读passwd,其次还要单独在samba中配置，否则passdb.tdb没有他的密码</strong>，我们可以使用命令pdbedit命令修改samba数据库
<ul>
<li><code>pdbedit -a &lt;username&gt;</code>：将某用户转化为samba用户并设置密码</li>
<li><code>pdbedit -x &lt;username&gt;</code>：将某samba用户从数据库中删除</li>
<li><code>pdbedit -L</code>：列出所有samba用户</li>
</ul></li>
<li>别名用户访问：与vsftpd的虚拟用户相似</li>
</ul>
<h3 id="基本使用">基本使用</h3>
<ul>
<li><p>创建samba用户</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 etc<span class="token punctuation">]</span><span class="token comment"># useradd -s /sbin/nologin smbtest</span>
<span class="token punctuation">[</span>root@C7B1 etc<span class="token punctuation">]</span><span class="token comment"># passwd smbtest </span>
<span class="token punctuation">[</span>root@C7B1 etc<span class="token punctuation">]</span><span class="token comment"># pdbedit -a smbtest</span></code></pre></li>
<li><p>访问到samba</p>
<p><strong>在windows下</strong>：安装和卸载程序里面安装cifs，直接win+R,<code>\\远程地址</code>(例如<code>\\192.168.245.175</code>)，命令没有写错，可以使用<code>net use * /del</code>清除缓存</p>
<p><strong>在linux下</strong>：如果有图形化桌面可以使用<code>\\远程地址</code>(例如<code>\\192.168.245.175</code>)登录，如果没有可以安装smbclient连接</p>
<p>列出帐户下所有位置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">smbclient -U smbtest -L //192.168.152.175 
<span class="token comment">#			 用户名      注意方向与win不同</span>
smbclient: Can<span class="token string">'t load /etc/samba/smb.conf - run testparm to debug it
Enter WORKGROUP\smbtest'</span>s password: 

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        IPC$            IPC       IPC Service <span class="token punctuation">(</span>Samba <span class="token number">4.10</span>.16<span class="token punctuation">)</span>
        smbtest         Disk      Home Directories
SMB1 disabled -- no workgroup available</code></pre>
<p>登陆</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">smbclient -U smbtest //192.168.152.175/smbtest
<span class="token comment">#									  这里写的是共享名，具体见后</span>
smbclient: Can<span class="token string">'t load /etc/samba/smb.conf - run testparm to debug it
Enter WORKGROUP\smbtest'</span>s password: 
Try <span class="token string">"help"</span> to get a list of possible commands.
smb: <span class="token punctuation">\</span><span class="token operator">></span> <span class="token function">ls</span>
  <span class="token builtin class-name">.</span>                                   D        <span class="token number">0</span>  Sun Mar <span class="token number">28</span> 09:10:04 <span class="token number">2021</span>
  <span class="token punctuation">..</span>                                  D        <span class="token number">0</span>  Sat Mar <span class="token number">27</span> <span class="token number">22</span>:08:08 <span class="token number">2021</span>
  .bash_logout                        H       <span class="token number">18</span>  Wed Apr  <span class="token number">1</span> <span class="token number">10</span>:17:30 <span class="token number">2020</span>
  .bash_profile                       H      <span class="token number">193</span>  Wed Apr  <span class="token number">1</span> <span class="token number">10</span>:17:30 <span class="token number">2020</span>
  .bashrc                             H      <span class="token number">231</span>  Wed Apr  <span class="token number">1</span> <span class="token number">10</span>:17:30 <span class="token number">2020</span>
  testfile                            N <span class="token number">2147483648</span>  Sat Mar <span class="token number">27</span> 08:54:04 <span class="token number">2021</span>
  ttt                                 D        <span class="token number">0</span>  Sun Mar <span class="token number">28</span> 08:47:18 <span class="token number">2021</span>
  文本文件.txt                    A        <span class="token number">2</span>  Sun Mar <span class="token number">28</span> 09:09:09 <span class="token number">2021</span>
  <span class="token number">123456</span>                              D        <span class="token number">0</span>  Sun Mar <span class="token number">28</span> 09:10:43 <span class="token number">2021</span>

                <span class="token number">5036032</span> blocks of size <span class="token number">1024</span>. <span class="token number">2905712</span> blocks available
smb: <span class="token punctuation">\</span><span class="token operator">></span> <span class="token comment"># 这里交互命令都是其自己实现的，与系统目录无关</span></code></pre></li>
<li><p>实现文件挂载</p>
<p>在windows下：此电脑-右击-映射网络驱动器-选择驱动器号，这里有一个规则，建议从后往前用(ZYX...)，选择文件夹<code>\\192.168.245.175\smbtest</code>勾选登陆时重新连接</p>
<p>linux下各种DE千奇百怪...</p>
<p>Linux命令界面下</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> -y samba-client cifs-utils 
<span class="token function">mount</span> -t cifs -o guest,vers<span class="token operator">=</span><span class="token number">1.0</span> //10.10.10.1/文件夹名/ /mnt/smb/
<span class="token comment"># 匿名用户登陆</span>
<span class="token function">mount</span> -t cifs -o <span class="token assign-left variable">username</span><span class="token operator">=</span>smbtest,password<span class="token operator">=</span><span class="token number">123456</span>,vers<span class="token operator">=</span><span class="token number">1.0</span> //192.168.245.175/smbtest /mnt/sm
<span class="token comment"># 有帐户的登录</span></code></pre>
<p>-o里的设置guest是免密码的，如果共享是有密码的话-o后面要跟username=XXX,password=XXX，XXX换成你的用户名和密码</p>
<p>永久挂载就是改fstab</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">//服务器ip/共享名 本地目录 cifs defaults,username<span class="token operator">=</span>XXX,password<span class="token operator">=</span>xxx <span class="token number">0,0</span> </code></pre></li>
<li><p>samba配置文件</p>
<p><code>/etc/samba/smb.conf</code>,可以参考模板<code>/etc/samba/smb.conf.example</code></p>
<p>文件由两部分global和share组成(;开头的是可能需要的配置，但是被注释了)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>global<span class="token punctuation">]</span>
	workgroup <span class="token operator">=</span> MYGROUP
	<span class="token comment"># 工作组名，windows的概念，如果不需要多服务器协同不需要</span>
	server string <span class="token operator">=</span> Samba Server Version %v
	<span class="token comment"># 版本号，一个string+一个宏变量，samba会自动获取值</span>
<span class="token punctuation">;</span>	netbios name <span class="token operator">=</span> MYSERVER
<span class="token punctuation">;</span>	interfaces <span class="token operator">=</span> lo eth0 <span class="token number">192.168</span>.12.2/24 <span class="token number">192.168</span>.13.2/24
	<span class="token comment"># samba默认监听的网卡(服务器)，可以写网卡，可以写ip/掩码</span>
<span class="token punctuation">;</span>	hosts allow <span class="token operator">=</span> <span class="token number">127</span>. <span class="token number">192.168</span>.12. <span class="token number">192.168</span>.13.
	<span class="token comment"># 允许那些客户端登陆 允许写网段，还有hosts deny写禁止的</span>
	<span class="token comment"># 还可以写成host allow=172. EXCEPT 172.18.5.102单独禁止</span>
	log <span class="token function">file</span> <span class="token operator">=</span> /var/log/samba/log.%m
	<span class="token comment"># 日志文件的位置，最后的%m是客户机主机名，相当于为每个主机名单独创建</span>
	max log size <span class="token operator">=</span> <span class="token number">50</span>
	<span class="token comment"># 日志最大容量(KB)，0为不限制，超过就再新建一个文件</span>
	security <span class="token operator">=</span> user
	<span class="token comment"># 访问smaba的默认验证方式为本地</span>
	passdb backend <span class="token operator">=</span> tdbsam
	<span class="token comment"># 默认用户密码验证机制为tdbsam</span>
<span class="token punctuation">;</span>	security <span class="token operator">=</span> domain
<span class="token punctuation">;</span>	passdb backend <span class="token operator">=</span> tdbsam
<span class="token punctuation">;</span>	realm <span class="token operator">=</span> MY_REALM
<span class="token punctuation">;</span>	password server <span class="token operator">=</span> <span class="token operator">&lt;</span>NT-Server-Name<span class="token operator">></span>
<span class="token punctuation">;</span>	security <span class="token operator">=</span> user
<span class="token punctuation">;</span>	passdb backend <span class="token operator">=</span> tdbsam
<span class="token punctuation">;</span>	domain master <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	domain logons <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	logon script <span class="token operator">=</span> %m.bat
<span class="token punctuation">;</span>	logon script <span class="token operator">=</span> %u.bat
<span class="token punctuation">;</span>	logon path <span class="token operator">=</span> <span class="token punctuation">\</span><span class="token punctuation">\</span>%L<span class="token punctuation">\</span>Profiles<span class="token punctuation">\</span>%u
<span class="token punctuation">;</span>	logon path <span class="token operator">=</span>
<span class="token punctuation">;</span>	<span class="token function">add</span> user script <span class="token operator">=</span> /usr/sbin/useradd <span class="token string">"%u"</span> -n -g <span class="token function">users</span>
<span class="token punctuation">;</span>	<span class="token function">add</span> group script <span class="token operator">=</span> /usr/sbin/groupadd <span class="token string">"%g"</span>
<span class="token punctuation">;</span>	<span class="token function">add</span> machine script <span class="token operator">=</span> /usr/sbin/useradd -n -c <span class="token string">"Workstation (%u)"</span> -M -d /nohome -s /bin/false <span class="token string">"%u"</span>
<span class="token punctuation">;</span>	delete user script <span class="token operator">=</span> /usr/sbin/userdel <span class="token string">"%u"</span>
<span class="token punctuation">;</span>	delete user from group script <span class="token operator">=</span> /usr/sbin/userdel <span class="token string">"%u"</span> <span class="token string">"%g"</span>
<span class="token punctuation">;</span>	delete group script <span class="token operator">=</span> /usr/sbin/groupdel <span class="token string">"%g"</span>
<span class="token punctuation">;</span>	<span class="token builtin class-name">local</span> master <span class="token operator">=</span> no
<span class="token punctuation">;</span>	os level <span class="token operator">=</span> <span class="token number">33</span>
<span class="token punctuation">;</span>	preferred master <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	wins support <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	wins server <span class="token operator">=</span> w.x.y.z
<span class="token punctuation">;</span>	wins proxy <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	dns proxy <span class="token operator">=</span> <span class="token function">yes</span>
	load printers <span class="token operator">=</span> <span class="token function">yes</span>
	<span class="token comment"># 是否加载打印机</span>
	cups options <span class="token operator">=</span> raw
<span class="token punctuation">;</span>	<span class="token function">printcap</span> name <span class="token operator">=</span> /etc/printcap
<span class="token punctuation">;</span>	<span class="token function">printcap</span> name <span class="token operator">=</span> lpstat
<span class="token punctuation">;</span>	printing <span class="token operator">=</span> cups
<span class="token punctuation">;</span>	map archive <span class="token operator">=</span> no
<span class="token punctuation">;</span>	map hidden <span class="token operator">=</span> no
<span class="token punctuation">;</span>	map <span class="token builtin class-name">read</span> only <span class="token operator">=</span> no
<span class="token punctuation">;</span>	map system <span class="token operator">=</span> no
<span class="token punctuation">;</span>	store dos attributes <span class="token operator">=</span> <span class="token function">yes</span>

<span class="token punctuation">[</span>homes<span class="token punctuation">]</span>
<span class="token comment"># 用于设置用户宿主目录的共享属性，他泛指了所有本地用户</span>
	comment <span class="token operator">=</span> Home Directories
	<span class="token comment"># 共享描述，随便写</span>
	browseable <span class="token operator">=</span> no
	<span class="token comment"># 共享资源是否可见，yes后张三登陆samba可以看到这个服务器上李四也在使用samba共享文件，虽然他进不去，但是可以看到李四的文件夹，no之后就看不到了</span>
	writable <span class="token operator">=</span> <span class="token function">yes</span>
	<span class="token comment"># 共享是否可写，还需要配置文件系统,虽然写入文件后所有者是本地用户，但是访问的时候还是其他人权限</span>
<span class="token punctuation">;</span>	valid <span class="token function">users</span> <span class="token operator">=</span> %S
	<span class="token comment"># 家目录允许谁访问，%s是自己，也可以写@XXX，表示允许XXX用户组的所有用户</span>
<span class="token punctuation">;</span>	valid <span class="token function">users</span> <span class="token operator">=</span> MYDOMAIN<span class="token punctuation">\</span>%S

<span class="token punctuation">[</span>printers<span class="token punctuation">]</span>
<span class="token comment"># 共享打印</span>
	comment <span class="token operator">=</span> All Printers
	path <span class="token operator">=</span> /var/spool/samba
	<span class="token comment"># 共享路径</span>
	browseable <span class="token operator">=</span> no
	guest ok <span class="token operator">=</span> no
	<span class="token comment"># 允许匿名访问</span>
	writable <span class="token operator">=</span> no
	printable <span class="token operator">=</span> <span class="token function">yes</span>
	<span class="token comment"># 是否可打印</span>
	
<span class="token punctuation">;</span>	<span class="token punctuation">[</span>netlogon<span class="token punctuation">]</span>
<span class="token comment"># 还可以自定义共享区域，[自定义(写的是\\IP\共享名的共享名)注意这就是那个共享名!]</span>
<span class="token punctuation">;</span>	comment <span class="token operator">=</span> Network Logon Service
<span class="token punctuation">;</span>	path <span class="token operator">=</span> /var/lib/samba/netlogon
<span class="token punctuation">;</span>	guest ok <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	writable <span class="token operator">=</span> no
<span class="token punctuation">;</span>	share modes <span class="token operator">=</span> no

<span class="token punctuation">;</span>	<span class="token punctuation">[</span>Profiles<span class="token punctuation">]</span>
<span class="token punctuation">;</span>	path <span class="token operator">=</span> /var/lib/samba/profiles
<span class="token punctuation">;</span>	browseable <span class="token operator">=</span> no
<span class="token punctuation">;</span>	guest ok <span class="token operator">=</span> <span class="token function">yes</span>

<span class="token punctuation">;</span>	<span class="token punctuation">[</span>public<span class="token punctuation">]</span>
<span class="token punctuation">;</span>	comment <span class="token operator">=</span> Public Stuff
<span class="token punctuation">;</span>	path <span class="token operator">=</span> /home/samba
<span class="token punctuation">;</span>	public <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token punctuation">;</span>	writable <span class="token operator">=</span> no
<span class="token punctuation">;</span>	printable <span class="token operator">=</span> no
<span class="token punctuation">;</span>	<span class="token function">write</span> list <span class="token operator">=</span> +staff</code></pre>
<p><code>testparm</code>用来检查配置文件语法是否正确，<code>-v</code>
显示其他参数</p></li>
<li><p>访问控制</p>
<ul>
<li><p>配置文件开启<code>writable=yes</code>文件夹开启+w写入权限，使用ACL权限最好</p></li>
<li><p>文件系统开启777，配置文件管控访问者(不推荐)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">readonly</span> <span class="token operator">=</span> <span class="token function">yes</span>
<span class="token function">write</span> list <span class="token operator">=</span> <span class="token operator">&lt;</span>user<span class="token operator">></span>,<span class="token operator">&lt;</span>user<span class="token operator">></span>,@<span class="token operator">&lt;</span>group<span class="token operator">></span></code></pre></li>
</ul></li>
</ul>
<h3 id="实验">实验</h3>
<ul>
<li><p><strong>安装软件包</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> -y samba samba-client samba-common</code></pre></li>
<li><p><strong>本地登陆实验</strong></p>
<p>我们自定义共享名</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>localusertest<span class="token punctuation">]</span>
        comment <span class="token operator">=</span> position <span class="token keyword">for</span> <span class="token builtin class-name">test</span> <span class="token keyword">for</span> <span class="token builtin class-name">local</span> user
        path <span class="token operator">=</span> /smbtest			<span class="token comment"># 制定一个路径，然后修改权限</span>
        public <span class="token operator">=</span> Yes			<span class="token comment"># 公开</span>
        writable <span class="token operator">=</span> Yes			<span class="token comment"># 可写(结合文件权限)</span>
        browseable <span class="token operator">=</span> Yes		<span class="token comment"># 可见</span></code></pre>
<p>修改文件权限</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> /smbtest/
<span class="token function">chmod</span> o+w /smbtest/
testparm</code></pre>
<p>创建并转化为samba用户：略</p>
<ul>
<li><p>访问控制：使用配置文件实现限制</p>
<p>只需要在共享名下修改允许访问用户列表<code>valid users = &lt;user&gt;,&lt;user&gt;,@&lt;group&gt;</code></p></li>
<li><p>对部分用户开放写权限</p>
<p>需要先设置所有人只读，然后设置白名单允许部分人可以写</p></li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">read</span> only <span class="token operator">=</span> Yes
<span class="token function">write</span> list <span class="token operator">=</span> smbtest</code></pre>
<ul>
<li>设置上传上来的文件权限</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash">create mask <span class="token operator">=</span> <span class="token number">644</span>
directory mask <span class="token operator">=</span> <span class="token number">755</span></code></pre>
<p>分别是创建文件的mask和创建文件夹的mask，注意，mask和umask不同，mask就是指文件权限，umask是掩码，需要计算一下</p></li>
<li><p>虚拟用户</p>
<p>配置文件在<code>etc/samba/smbusers</code>[新文件]，文件格式是：<code>Linux用户名 = 别名1 别名2</code></p>
<p>修改主配置文件，在global下写下</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">username map <span class="token operator">=</span> /etc/samba/smbusers</code></pre></li>
</ul>
<h2 id="nfs服务">NFS服务</h2>
<p>网络文件系统协议，目的是通过网络让不同机器彼此分享数据，是unix下的一种文件共享方法C/S架构</p>
<p>与samba不同的是，NFS使用NFS协议，Samba使用Samba协议，NFS适合在类Unix下进行文件分享，NFS对于传输与访问控制更加专业</p>
<p>NFS一般用来存储与共享视频图像资源等静态数据</p>
<h3 id="nfs挂载原理">NFS挂载原理</h3>
<p>往常我们访问服务的时候会直接访问某个端口，但是NFS使用的是随机端口，所以第一次连接就很难建立　　　</p>
<ul>
<li><p>NFS启动后会向RPC(原名portmap)注册端口号，RPC开放111端口</p></li>
<li><p>客户端通过RPC(原创过程调用)协议与服务器连接，获得NFS端口</p></li>
<li><p>客户端与服务器端连接</p></li>
</ul>
<p>所以启动服务的时候要先启动RPC,之后NFS启动后会向PRC注册自己的端口号</p>
<p><strong>注意</strong>：一般在修改nfs配置文件后不建议重启服务，这样会导致随机端口变化，建议使用reload重新加载</p>
<h3 id="实验-1">实验</h3>
<p><strong>软件名</strong></p>
<p><code>nfs-utils-*</code>：NFS软件(一般默认有)</p>
<p><code>rpcbind-*</code>：NFS与RPC服务连接(一般默认有)</p>
<p><strong>服务名</strong></p>
<p><code>nfs</code>与<code>rpcbind</code></p>
<p><strong>配置</strong></p>
<ul>
<li>主配置文件：<code>/etc/exports</code></li>
<li>格式：<code>共享目录 客户端1(权限,用户映射,其他) 客户端2(权限,用户映射,其他)...</code></li>
<li>客户端：可以用IP(只写IP即可)，网段(192.168.2.0/255.255.255.0
不能省略)，主机，域下的所有主机，*：所有主机</li>
<li>权限：ro与rw，只读和读写</li>
<li>用户映射选项：
<ul>
<li><code>root_squash</code>：将本地的root映射到服务器用户<code>nfsnobody</code></li>
<li><code>no_root_squash</code>：保留管理员权限，将本地的root映射到服务器的root</li>
<li><code>all_squash</code>：将所有客户机用户映射到一个服务器用户
<ul>
<li><code>anonuid=xxx</code>映射到服务器xxx UID</li>
<li><code>annogid=xxx</code>映射到服务器xxx GID</li>
</ul></li>
</ul></li>
<li>其他选项
<ul>
<li><code>sync</code>同步传输(只要客户端出现一个文件，服务器就马上创建)，效率低，数据一致性高</li>
<li><code>async</code>先将数据保存在内存缓存区，必要时写入磁盘</li>
</ul></li>
</ul>
<p><strong>使用</strong></p>
<ul>
<li><p>查看RPC开启了那些端口</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">rpcinfo -p localhost</code></pre></li>
<li><p>查看nfs共享了哪些位置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">expoerfs</code></pre>
<p>或者使用这个命令查看本机或原创共享NFS</p>
<pre class="language-none"><code class="language-none">showmount -e IP</code></pre></li>
<li><p>客户端挂载</p>
<p>安装nfs客户端，启动</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum  <span class="token function">install</span> nfs-utils -y
systemctl start nfs-utils
systemctl <span class="token builtin class-name">enable</span> nfs-utils</code></pre>
<p>如果没有安装可能会在挂载的时候报错坏的超级块</p>
<p>挂载</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mount</span> -t nfs -o <span class="token assign-left variable">vers</span><span class="token operator">=</span><span class="token number">3</span> 服务器IP:服务器共享文件夹完整路径 挂载路径</code></pre>
<p>注意
这里要写的是目标位置的完整路径，-o是自定义参数的开关，制定使用nfsv3版本，这样可以避免同步延迟，例如</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mount</span> -t nfs -o <span class="token assign-left variable">vers</span><span class="token operator">=</span><span class="token number">3</span> <span class="token number">192.168</span>.73.175:/var/nfstest /mnt/nfs</code></pre>
<p>自动挂载</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token number">192.168</span>.73.175:/var/nfstest /mnt/nfs defaults,vers<span class="token operator">=</span><span class="token number">3</span> <span class="token number">0</span> <span class="token number">0</span></code></pre></li>
<li><p>将客户机root映射到服务器root(默认是nfsnobody)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">/var/nfstest <span class="token number">192.168</span>.73.0/255.255.255.0<span class="token punctuation">(</span>rw,no_root_squash<span class="token punctuation">)</span></code></pre></li>
<li><p>将客户机所有用户映射到服务器某个用户</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 nfstest<span class="token punctuation">]</span><span class="token comment"># useradd -s /sbin/nologin nfsuser1</span>
<span class="token punctuation">[</span>root@C7B1 nfstest<span class="token punctuation">]</span><span class="token comment"># passwd nfsuser1</span>
<span class="token punctuation">[</span>root@C7B1 nfstest<span class="token punctuation">]</span><span class="token comment"># id nfsuser1</span>
<span class="token assign-left variable">uid</span><span class="token operator">=</span><span class="token number">1006</span><span class="token punctuation">(</span>nfsuser1<span class="token punctuation">)</span> <span class="token assign-left variable">gid</span><span class="token operator">=</span><span class="token number">1006</span><span class="token punctuation">(</span>nfsuser1<span class="token punctuation">)</span> 组<span class="token operator">=</span><span class="token number">1006</span><span class="token punctuation">(</span>nfsuser1<span class="token punctuation">)</span>
<span class="token punctuation">[</span>root@C7B1 nfstest<span class="token punctuation">]</span><span class="token comment"># vim /etc/exports</span>
	/var/nfstest <span class="token number">192.168</span>.73.0/255.255.255.0<span class="token punctuation">(</span>rw,anonuid<span class="token operator">=</span><span class="token number">1006</span>,anongid<span class="token operator">=</span><span class="token number">1006</span><span class="token punctuation">)</span></code></pre>
<p>客户机创建文件后服务器上显示所有者是nfsuser1，客户端显示所有者是1006，因为客户机没有1006用户名字，但是如果创建了一个id为1006的用户，叫做wangmazi那么客户端就会显示所有者wangmazi,这个纯属巧合，不用管。所以我们建议用一个比较大的UID作为服务器映射用户</p></li>
<li><p>卸载</p>
<p>客户端卸载</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">umount</span> 挂载点</code></pre>
<p>服务器强制停止所有客户机的挂载，但是不停nfs</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">exportfs -au</code></pre>
<p>服务器重挂载所有客户机</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">exportfs -ra</code></pre></li>
</ul>
<p><strong>exportfs命令</strong></p>
<p>在启动nfs，修改/etc/exports后可以使用exportfs命令立刻生效改动</p>
<p><code>-a</code> 全部客户机(可以加开关指定挂载或者卸载)</p>
<p><code>-v</code> 输出详细信息</p>
<p><code>-r</code>重新读取/etc/exports并同步更新</p>
<p><code>-u [host:path]</code>卸载某个目录，例如<code>exportfs -u 192.168.73.0/255.255.255.0:/var/nfstest/</code></p>
<p>常见组合</p>
<p><code>-au</code>卸载所有目录</p>
<p><code>-ra</code>重挂载所有目录</p>
<h2 id="lamp平台">LAMP平台</h2>
<p>就是Linux Apache MySQL Php平台的缩写，具体分工是</p>
<ul>
<li>Linux：DHCP,DNS服务</li>
<li>Apache：网页服务器，可以简单的理解成将请求发文件还给用户的机器</li>
<li>PHP：解析PHP动态页面，完成内容，发送给用户</li>
<li>MySQL：数据库</li>
</ul>
<h3 id="环境搭建">环境搭建</h3>
<p>CentOS6的yum一直连不上，遂放弃</p>
<p>以下介绍了软件包常见依赖和作用，但最后是使用CentOS7 yum安装的</p>
<p><strong>编译安装的注意事项</strong></p>
<ul>
<li><p>源码包安装出错常见解决方案：<code>echo $?</code>查看返回值，如果是./configure的问题大多是依赖问题，如果是make问题大多是选项写错</p></li>
<li><p>要二次确认正确安装：看安装目录下有没有文件，确定安装目录是否正确</p></li>
<li><p>安装三步：<code>configure</code>文件检查环境，make根据configure将源码编译成二进制，make
install按照configure制定的选项安装</p></li>
</ul>
<p><strong>环境准备</strong></p>
<ul>
<li><p>关闭防火墙 SELinux</p></li>
<li><p>网络安装gcc,gcc-c++,make</p>
<p>这是用来编译源码包的</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> -y gcc* <span class="token function">make</span></code></pre></li>
<li><p>查询并关闭rpm安装的Apache和MySQL 防止冲突</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># rpm -q mysql-server</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># rpm -q httpd</span></code></pre>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># systemctl disable httpd</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># systemctl stop httpd</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># systemctl stop mysql-server</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># systemctl disable mysql-server</span></code></pre></li>
</ul>
<p><strong>安装PHP</strong></p>
<ul>
<li><p>安装依赖libxml2</p>
<p>一个跨平台的C语言的xml解析器，因为xml是很多软件的配置文件的格式，建议安装</p></li>
<li><p>安装依赖libmcrypt</p>
<p>加密算法函数库，被PHP直接调用，用于传输加密</p>
<ul>
<li><p>安装mhash与mcrypt</p>
<p>被libmcrypt调用的加密函数库</p></li>
</ul></li>
<li><p>安装依赖zlib</p>
<p>PHP依赖的压缩函数库，用来传输文件的时候压缩</p></li>
<li><p>安装依赖libpng和jpeg6</p>
<p>PHP用来解码png和jpeg,jpg的函数库</p></li>
<li><p>安装依赖freetype</p>
<p>一个可移植的字体引擎</p></li>
<li><p>安装PHP</p></li>
<li><p>安装PHP的openSSL模块</p>
<p>不是openSSL软件，这是一个模块，PHP需要借助这个模块调用openSSL</p></li>
<li><p>安装PHP的memcache模块</p></li>
<li><p>安装phpMyAdmin</p></li>
</ul>
<p><strong>安装Apache</strong></p>
<ul>
<li><p>安装依赖pcre和apr*</p></li>
<li><p>安装依赖mod_ssl</p>
<p>用于https</p></li>
<li><p>安装apache</p>
<p>AH00558报错：服务器主机名使用了安装默认的，与本机主机名不同，需要修改配置文件200行左右的主机名</p>
<p>检查配置文件错误：<code>/sur/local/apache2/bin/apachectl restart</code></p></li>
</ul>
<p><strong>安装MySQL</strong></p>
<ul>
<li><p>安装相关ncurses</p>
<p>一个终端的MySQL操作工具</p></li>
<li><p>安装MySQL</p></li>
</ul>
<p><strong>在CentOS7下安装</strong></p>
<ul>
<li><p>apache：yum直装</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> httpd</code></pre></li>
<li><p>PHP：yum安装</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> php freetype libpng memcached libxml2 libpng zlib php php-fpm</code></pre>
<p>修改httpd配置文件让他识别php</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">AddType application/x-httpd-php .php .phtml
AddType application/x-httpd-php-source .phps</code></pre></li>
<li><p>MySQL：yum 安装</p>
<p>添加用户 安装依赖</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">useradd</span> -r -s /sbin/nologin mysql
<span class="token function">passwd</span> mysql
yum <span class="token function">install</span> -y ncurses bison cmake</code></pre>
<p>安装mysql</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token comment"># 下载mysql的repo源</span>
<span class="token function">wget</span> http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm
<span class="token comment"># 安装mysql-community-release-el7-5.noarch.rpm包</span>
<span class="token function">rpm</span> -ivh mysql-community-release-el7-5.noarch.rpm
<span class="token function">sudo</span> yum <span class="token function">install</span> mysql-server</code></pre>
<p>修改文件权限和用户</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">chown</span> -R root:root /var/lib/mysql
systemctl start mysqld
mysql -u root
mysql<span class="token operator">></span> use mysql
mysql<span class="token operator">></span> update user <span class="token builtin class-name">set</span> <span class="token assign-left variable">password</span><span class="token operator">=</span>password<span class="token punctuation">(</span><span class="token string">"lkr0101"</span><span class="token punctuation">)</span> where <span class="token assign-left variable">user</span><span class="token operator">=</span><span class="token string">'root'</span><span class="token punctuation">;</span></code></pre></li>
<li><p>Apache在CentOS7中默认只开启了IPv6的80口，需要手动开启IPv4的80口，需要修改配置文件</p></li>
</ul>
<p><strong>实际上的安装</strong></p>
<p>没有这么麻烦</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token comment"># 安装Apache及其依赖</span>
yum <span class="token function">install</span> httpd httpd-devel mod_ssl
<span class="token comment"># 启动Apache</span>
systemctl start httpd
systemctl <span class="token builtin class-name">enable</span> httpd
<span class="token comment"># 安装MySQL(直接用mairadb替代)</span>
yum <span class="token function">install</span> mariadb mariadb-server mariadb-libs mariadb-devel
<span class="token comment"># 开启MySQL</span>
systemctl start  mariadb 
systemctl <span class="token builtin class-name">enable</span>  mariadb 
<span class="token comment"># 设置MySQL密码等安全设置</span>
mysql_secure_installation 
mysql -uroot -p
<span class="token comment"># 安装PHP</span>
yum -y <span class="token function">install</span> php
<span class="token comment"># 连接PHP和MySQL</span>
yum <span class="token function">install</span> php-mysql
<span class="token comment"># 安装PHP依赖</span>
yum <span class="token function">install</span> -y php-gd php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-snmp php-soap <span class="token function">curl</span> curl-devel php-bcmath
<span class="token comment"># 安装PHP的memcached</span>
yum <span class="token function">install</span> memcached php-pecl-memcache
<span class="token comment"># 验证安装成功</span>
memcached -h
php -m<span class="token operator">|</span><span class="token function">grep</span> memcache
<span class="token comment"># 开启服务</span>
systemctl start memcached
systemctl <span class="token builtin class-name">enable</span> memcached
<span class="token comment"># 查看端口开启</span>
<span class="token function">lsof</span> -i tcp:11211
<span class="token comment"># 安装libmcrypt</span>
yum <span class="token function">install</span> epel-release
yum update
yum <span class="token function">install</span> libmcrypt libmcrypt-devel mcrypt mhash  
<span class="token comment"># 构建info.php页面</span>
<span class="token builtin class-name">cd</span> /var/www/html/
<span class="token function">vi</span> info.php
    <span class="token operator">&lt;</span>?php
        phpinfo<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    ?<span class="token operator">></span>
systemctl restart httpd
<span class="token comment"># 访问http://服务器IP/info.php</span></code></pre>
<p><strong>尝试部署typecho到Apache</strong></p>
<p><a target="_blank" rel="noopener" href="http://typecho.org/">下载</a>包</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">tar</span> -xf <span class="token number">1.1</span>-17.10.30-release.tar.gz 
<span class="token function">cp</span> -r ~/build/ /var/www/html/
mysql -uroot -plkr0101
	create DATABASE typecho
setfacl -m u:daemon:rwx /var/www/html/build
systemctl restart httpd</code></pre>
<p>访问http://服务器IP/build</p>
<h2 id="apache">Apache</h2>
<p>跨平台的服务器软件，最流行的服务器软件之一，可以通过API扩充可以支持PHP,Python...
全线支持SSL,虚拟主机，<strong>Apache</strong>是以进程为基础结构的，比其他应用线程为基础结构的相比不适合多处理器模式</p>
<h3 id="启动方式">启动方式</h3>
<ul>
<li>系统先启动init进程</li>
<li>init进程启动http守护进程</li>
<li>http守护进程 启动服务的子进程(例如www)</li>
<li>http守护进程启动模块</li>
</ul>
<h3 id="工作模式">工作模式</h3>
<p>有三种稳定的MPM(m多进程处理模块)工作模式：prefork,worker,event</p>
<ul>
<li><p>prefork模式</p>
<p>Apache启动后，会先开启一个fork进程，收到请求后再新开一个处理进程</p>
<p>成熟稳定，线程之间独立安全，但是消耗内存大，不能高并发</p></li>
<li><p>worker模式</p>
<p>预先定义几个子进程(不多)，每个子进程创建一点子线程(不多)和一个子监听线程，每收到一个请求，监听线程会分配请求到一个小线程，由于线程之间可以共享父进程的内存，比较高效</p>
<p>支持高并发，但是存在线程安全问题</p></li>
<li><p>event模式</p>
<p>keep-live场景：http1.1下的持久连接，在一次对象传输结束之后，会有keepalive_timeout，如果超时还没有新的请求才会断开tcp，但是他可能产生无效的占用</p>
<p>event与worker模式相似，但是解决的keep-alive场景资源浪费的问题，也就是在没有足够连接的时候断开一些很久没有传输文件的keepalive</p>
<p>高效但是不支持https</p></li>
<li><p>查看apache工作模式</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">httpd -V <span class="token operator">|</span> <span class="token function">grep</span> -i <span class="token string">"server mpm"</span></code></pre></li>
</ul>
<h3 id="文件位置">文件位置</h3>
<ul>
<li><p>配置文件</p>
<p>源码安装：<code>PREFIX/etc/httpd.conf</code>,子配置文件：<code>PREFIX/etc/rxtra/*.conf</code></p>
<p>PRM安装：<code>/etc/httpd/conf/httpd.conf</code></p></li>
<li><p>网页文件位置</p>
<p>源码安装：<code>PREFIX/htdocs/</code></p>
<p>RPM安装：<code>/var/www/html/</code></p></li>
<li><p>日志文件位置</p>
<p>源码安装：<code>PREFIX/logs/</code></p>
<p>RPM安装：<code>/var/log/httpd</code></p></li>
</ul>
<h3 id="配置文件">配置文件</h3>
<p>==在写Apache配置文件的时候最好写绝对路径，注释换行，行尾无空格==</p>
<ul>
<li><p>主机环境变量配置参数</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">ServerRoot <span class="token string">"/etc/httpd"</span>					<span class="token comment"># apache主目录</span>
Listen <span class="token number">80</span>								<span class="token comment"># 服务器监听端口</span>
Include conf.modules.d/*.conf			<span class="token comment"># 加载模块</span>
User apache								<span class="token comment"># apache以什么用户登陆</span>
Group apache
ServerAdmin root@localhost				<span class="token comment"># 服务器名，和主机名一样没啥用？</span>
ErrorLog <span class="token string">"logs/error_log"</span>				<span class="token comment"># 错误日志</span>
CustomLog <span class="token string">"logs/access_log"</span> common		<span class="token comment"># 访问记录日志</span>
DirectoryIndex index.html				<span class="token comment"># 网页文件名，按优先级写</span>
Include conf.modules.d/*.conf			<span class="token comment"># 生效子配置文件</span></code></pre></li>
<li><p>主页目录和权限</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">DocumentRoot <span class="token string">"/var/www/html"</span>			<span class="token comment"># 网页目录</span>
<span class="token operator">&lt;</span>Directory <span class="token string">"/var/www"</span><span class="token operator">></span>					<span class="token comment"># 使用这个语法可以定义目录权限</span>
	Options Indexes FollowSymLinks		<span class="token comment"># 访问服务器时候的访问权限</span>
	<span class="token comment"># Index权限可以修改为</span>
	<span class="token comment"># None								# 没有额外权限(访问目录找不到Index直接404)</span>
	<span class="token comment"># All								# 给所有权限</span>
    <span class="token comment"># Indexes							# 给浏览权限(找不到html后开启目录浏览)</span>
    <span class="token comment"># FollowSymLinks可以修改为</span>
    <span class="token comment"># FollowSymLinks					# 软连接到其他目录</span>
	<span class="token comment"># MultiViews						# 允许文件名泛匹配(前提是开启了negotitation)</span>
    AllowOverride None					<span class="token comment"># 允许.htaccess文件中权限生效</span>
    <span class="token comment"># None								# .htaccess文件中权限不生效</span>
    <span class="token comment"># All								# .htaccess文件中权限生效</span>
    <span class="token comment"># AuthConfig						# .htaccess文件中权限只有网页认证的生效</span>
    Require all granted					<span class="token comment"># 访问控制列表</span>
    <span class="token comment"># Require all granted 允许所有连接</span>
    <span class="token comment"># Require all granted (denied) 禁止所有访问</span>
    <span class="token comment"># 但是一般都是用防火墙管控，用这个的不多</span>
<span class="token operator">&lt;</span>/Directory<span class="token operator">></span>

<span class="token operator">&lt;</span>IfModule dir_module<span class="token operator">></span>
    DirectoryIndex index.html			<span class="token comment"># 网页文件名，按优先级写</span>
<span class="token operator">&lt;</span>/IfModule<span class="token operator">></span></code></pre></li>
</ul>
<h3 id="apache目录别名实验">Apache目录别名实验</h3>
<p>默认情况下Apache接受的请求后会返回对应路径下的文件，例如XXX.com/t/s页面，Apache会访问<code>/var/www/html/t/s/index.html</code>但是，有的时候我们不想吧某个页面和其他页面混合起来，于是可以设置别名，例如将<code>XXX.com/t/s</code>重定向到其他文件夹</p>
<ul>
<li>修改主配置文件，让其引用别名子配置文件</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash">IncludeOptional conf.d/*.conf</code></pre>
<p>正好默认就引用了</p>
<ul>
<li>在子配置文件中追加</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash">Alias /anothersite/ <span class="token string">"/var/www/html/build/"</span></code></pre>
<p>实现了将http://192.168.95.175/anothersite/别名到/var/www/html/build/目录</p>
<p>注意写别名的时候一定要区分最后加不加<code>/</code>不加代表文件，加上代表目录</p>
<h3 id="apache用户验证">Apache用户验证</h3>
<p>设置当访问服务器下的某个<strong>目录</strong>时需要输入用户名密码才可以访问，也就是说我们这个认证是在加载里面网页之前做的</p>
<p>设置加密目录<code>/var/www/html/lockdir/</code></p>
<p>主配置文件设置目录保护声明</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token operator">&lt;</span>Directory <span class="token string">"/var/www/html/lockdir"</span><span class="token operator">></span>
    AllowOverride All					<span class="token comment"># 开启权限认证文件</span>
    Options Indexes FollowSymLinks		
    Require all granted
<span class="token operator">&lt;</span>/Directory<span class="token operator">></span></code></pre>
<p>配置网页的登陆信息，在目录下创建/var/www/html/lockdir/.htaccess</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">AuthName <span class="token string">"Welcom"</span>									<span class="token comment"># 提示信息 </span>
AuthType basic										<span class="token comment"># 加密类型 基础</span>
AuthUserFile /var/www/html/lockdir/apache.passwd	<span class="token comment"># 密码保存在</span>
require valid-user									<span class="token comment"># 允许所有在passwd的文件访问</span></code></pre>
<p>创建密码文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">htpasswd -c /var/www/html/lockdir/apache.passwd lkr1	<span class="token comment"># 创建文件 创建用户 -c</span>
htpasswd -m /var/www/html/lockdir/apache.passwd lkr2	<span class="token comment"># 已有文件 创建用户 -m</span></code></pre>
<p>重启httpd，时间会很长</p>
<h3 id="虚拟主机实验">虚拟主机实验</h3>
<p><strong>虚拟机和虚拟主机</strong></p>
<p>虚拟机是在物理机器上虚拟一套硬件，安装一套真正的操作系统实现的主机</p>
<p>虚拟主机是在一个物理机上划分出很多虚拟的空间，空间里面没有操作系统，只是负责实现一套服务器主机</p>
<p><strong>虚拟主机的类型</strong></p>
<ul>
<li>基于IP的虚拟主机：一个服务器，多个IP,不同IP不同主机，公网IP很贵</li>
<li>基于端口的虚拟主机：一个服务器，一个IP,不同端口不同主机，但是只有80可以默认访问</li>
<li>基于域名的虚拟主机：一个服务器，一个IP，不同域名不同虚拟主机</li>
</ul>
<p><strong>创建基于域名的虚拟主机</strong></p>
<ul>
<li><p>在<code>/var/www/</code>创建两个网页文件，并写入html文件</p></li>
<li><p>修改客户机hosts，两个域名全部指向服务器</p></li>
<li><p>修改主配置文件Include一个conf文件，yum安装的正好是include *
所以不用配置，直接</p></li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">touch</span> etc/httpd/conf.d/virtual.conf</code></pre>
<ul>
<li>编辑子配置文件virtual.conf</li>
</ul>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token operator">&lt;</span>Directory <span class="token string">"/var/www/baidu/"</span><span class="token operator">></span>				<span class="token comment"># 配置网页文件夹</span>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
<span class="token operator">&lt;</span>/Directory<span class="token operator">></span>

<span class="token operator">&lt;</span>VirtualHost <span class="token number">10.132</span>.104.188:8<span class="token operator"><span class="token file-descriptor important">0</span>></span>				<span class="token comment"># 这里要写监听网卡和端口，全部可以写*</span>
        ServerAdmin lkr@163.com
        DocumentRoot <span class="token string">"/var/www/baidu/"</span>
        ServerName www.baidu.com			<span class="token comment"># 写域名</span>
        ErrorLog <span class="token string">"logs/baidu-error_log"</span>		<span class="token comment"># 写日志</span>
        CustomLog <span class="token string">"logs/baidu-access_log"</span> common
<span class="token operator">&lt;</span>/VirtualHost<span class="token operator">></span>

<span class="token comment"># 另一个同理</span></code></pre>
<ul>
<li>重启http即可</li>
</ul>
<h3 id="域名跳转实验">域名跳转实验</h3>
<p>域名跳转有301永久跳转和302临时跳转，建议服务器使用301，对搜索引擎友好</p>
<p>主配置文件添加模块</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">LoadModule rewrite_module modules/mod_rewrite.so</code></pre>
<p>这个模块是yum安装httpd就有的</p>
<p>修改虚拟主机的子配置文件，<strong>我们的目标是将baidu301到zhihu</strong>,于是修改配置文件</p>
<pre class="language-diff" data-language="diff"><code class="language-diff"><span class="token deleted-arrow deleted"><span class="token prefix deleted">&lt;</span><span class="token line">Directory "/var/www/baidu/">
</span></span><span class="token unchanged"><span class="token prefix unchanged"> </span><span class="token line">       Options Indexes FollowSymLinks
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line">       AllowOverride Null
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line">       AllowOverride All
</span></span><span class="token unchanged"><span class="token prefix unchanged"> </span><span class="token line">       Require all granted
</span></span><span class="token deleted-arrow deleted"><span class="token prefix deleted">&lt;</span><span class="token line">/Directory></span></span></code></pre>
<p>创建 /var/www/baidu/.htaccess</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">RewriteEngine on
<span class="token comment"># 开启重定向</span>
RewriteCond %<span class="token punctuation">&#123;</span>HTTP_HOST<span class="token punctuation">&#125;</span> ^www.baidu.com
<span class="token comment"># 如果匹配到www.baidu.com开头的域名，那么执行RewriteRule</span>
RewriteRule ^<span class="token punctuation">(</span>.*<span class="token punctuation">)</span>$ http://www.zhihu.com/<span class="token variable">$1</span> <span class="token punctuation">[</span>R<span class="token operator">=</span>permanent,L<span class="token punctuation">]</span>
<span class="token comment"># ^(.*)$ 匹配域名，实际上这条命令受到的就只有www.baidu.com/123中的/123</span>
<span class="token comment"># $1 前面匹配到的内容</span>
<span class="token comment"># R=... 定义网页重定向 L表示这是最后一条配置，永久重定向</span></code></pre>
<h3 id="apacheopenssl实验https">Apache+OpenSSL实验https</h3>
<p>编辑主配置文件，开启SSL</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token operator">&lt;</span>IfModule ssl_module<span class="token operator">></span>
        SSLRandomSeed startup <span class="token builtin class-name">builtin</span>
        SSLRandomSeed connect <span class="token builtin class-name">builtin</span>
<span class="token operator">&lt;</span>/IfModule<span class="token operator">></span>
LoadModule ssl_module modules/mod_ssl.so</code></pre>
<p>生成CA证书</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> /etc/httpd/conf/cert					<span class="token comment"># 实际上这个位置是随意的</span>
<span class="token builtin class-name">cd</span> /etc/httpd/conf/cert
openssl genrsa -out ca.key
openssl req -new -key ca.key -out test.csr
openssl x509 -req -days <span class="token number">365</span> -sha256 -in test.csr -signkey ca.key -out test.crt</code></pre>
<p>在/etc/httpd/conf.d/ssl.conf下修改文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">SSLProtocol all -SSLv2 -SSLv3				<span class="token comment"># 支持的SSL协议</span>
SSLCipherSuite HIGH:<span class="token operator">!</span>RC4:<span class="token operator">!</span>MD5:<span class="token operator">!</span>aNULL:<span class="token operator">!</span>eNULL:<span class="token operator">!</span>NULL:<span class="token operator">!</span>DH:<span class="token operator">!</span>EDH:<span class="token operator">!</span>EXP:+MEDIUM
<span class="token comment"># 修改加密套件配置</span>
SSLHonorCipherOrder on 
<span class="token comment"># 开启服务</span>
SSLCertificateFile /etc/httpd/conf/cert/test.crt
SSLCertificateKeyFile /etc/httpd/conf/cert/ca.key
<span class="token comment"># 证书密钥位置</span></code></pre>
<p>目前，我们实现了开启SSL,但是SSL并不能直接加载在80口上，只能跑在443口上，我们需要使用虚拟主机开启443口，之后用户访问http://www.123.com会跳转到80,但是访问https://www.123.com会跳转到443口，所以接下里配置虚拟主机，在主配置文件中写下</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token operator">&lt;</span>VirtualHost *:44<span class="token operator"><span class="token file-descriptor important">3</span>></span>					<span class="token comment"># 监听所有443口</span>
    ServerAdmin lkr@163.com
    DocumentRoot <span class="token string">"/var/www/html/"</span>	<span class="token comment"># 网站根目录，甚至可以和80的不同</span>
    ServerName localhost:443		<span class="token comment"># 域名</span>
    SSLCertificateFile /etc/httpd/conf/cert/test.crt
	SSLCertificateKeyFile /etc/httpd/conf/cert/ca.key
	SSLCertificateChainFile /etc/httpd/conf/cert/test.crt
<span class="token operator">&lt;</span>/VirtualHost<span class="token operator">></span></code></pre>
<p>如果报错：XXX not support(known name XXX)，maybe you need to load
XXX，就是少了模块，加载一下</p>
<p>重启Apache，分别访问http,https,可以看到https的SSL证书，与之前的转发相似，在主配置文件下找到80的目录，里面写入</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">RewriteEngine on
RewriteCond %<span class="token punctuation">&#123;</span>SERVER_PORT<span class="token punctuation">&#125;</span> <span class="token operator">!</span>^443$
RewriteRule ^<span class="token punctuation">(</span>.*<span class="token punctuation">)</span>$ https://%<span class="token punctuation">&#123;</span>SERVER_NAME<span class="token punctuation">&#125;</span>/<span class="token variable">$1</span> <span class="token punctuation">[</span>R<span class="token operator">=</span><span class="token number">301</span>,L<span class="token punctuation">]</span></code></pre>
<h3 id="apache日志切割">Apache日志切割</h3>
<p>实验环境：恢复快照到LAMP搭建完成</p>
<p>Apache提供有了日志服务，有两种：错误日志和访问日志，直接写在主配置文件目录下，例如</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">ErrorLog <span class="token string">"logs/baidu-error_log"</span> combined
CustomLog <span class="token string">"logs/baidu-access_log"</span> common</code></pre>
<p>这里的combined和common是制定日期记录的格式，combined记录的比较详细</p>
<p><strong>开启日志切割</strong>：举例：将错误日志修改为每天一个文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">ErrorLog <span class="token string">"|/sbin/rotatelogs -l /etc/httpd/logs/error_%Y%m%d.log 86400"</span></code></pre>
<p>本来日志是直接写入文件的，现在管道到rotatelogs命令，然后按照日期切割，切割到制定目录，时间是86400s=1天</p>
<p>虽然这个rotatelogs是在sbin下，但是不是系统命令，是apache安装的</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 sbin<span class="token punctuation">]</span><span class="token comment"># rpm -qf rotatelogs </span>
httpd-2.4.6-97.el7.centos.x86_64</code></pre>
<p>记得还有子配置文件里面也要改</p>
<h3 id="apache不记录某类型文件">Apache不记录某类型文件</h3>
<p>例如不记录图片格式的请求</p>
<p>修改主配置文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">SetEnvIf Request_URL <span class="token string">"*.jpg$"</span> img-req
SetEnvIf Request_URL <span class="token string">"*.png$"</span> img-req
<span class="token punctuation">..</span>.
CustomLog <span class="token string">"logs/baidu-log"</span> combined env<span class="token operator">!=</span>img-req</code></pre>
<p>意思就是如果一个访问的连接是获取图片，那么这是为环境img-req，设置服务器记录日志的时候不记录img-req环境的</p>
<h3 id="apache静态缓存">Apache静态缓存</h3>
<p>网页有一些js/图片/css文件是静态的，并且会被频繁访问，这些数据如果可以被缓存到电脑上那么就不需要缓存了，但是这个文件也不能一直缓存，有一定的时效性</p>
<p>配置主配置文件(混出图片一天为例子)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">LoadModule expires_module modules/mod_expires.so
<span class="token operator">&lt;</span>IfModule expires_module<span class="token operator">></span>
    ExpiresActive on
    ExpiresByType image/gif <span class="token string">"access plus 1 days"</span>
    <span class="token comment"># days可以换成 years、months、weeks、days、hours、minutes、seconds甚至可以组合</span>
    <span class="token comment"># access可以缓存now或者modification,一个意思是自access/now都表示自这次访问后多久，modification是自网页上次被修改后多久</span>
    <span class="token comment"># A12345 表示access plus 12345秒</span>
<span class="token operator">&lt;</span>/IfModule<span class="token operator">></span></code></pre>
<h3 id="apache禁止解析php">Apache禁止解析PHP</h3>
<p>设置某些目录进行PHP解析，例如有个目录是专门上传图片的，如果不加以防范，有人可能会吧脚本上传上来，被PHP解析，直接在目录内部写下</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">php_admin_flag engine off
<span class="token operator">&lt;</span>filesmatch <span class="token string">"(.*)php"</span><span class="token operator">></span>
	Order deny,allow
	Deny from all
<span class="token operator">&lt;</span>/filesmatch<span class="token operator">></span></code></pre>
<h2 id="lnmp平台">LNMP平台</h2>
<p>将LAMP的Apache换成了Nginx</p>
<p>需要恢复到安装LAMP前的快照</p>
<p>本次安装为yum安装依赖，最新版源码包安装LNMP本体</p>
<p><strong>安装前务必检查磁盘空间，我以前听别人说因为磁盘空间不足编译失败了，还以为是笑话，没想到小丑竟是我自己，分配了14G给/结果因为空间不足编译失败了，MySQL要求内存2G+</strong></p>
<p><strong>配置yum源</strong></p>
<p>需要的有国内的Base源和epel扩展源(提供了yum官方没有的软件包)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">cd</span> /etc/yum.repos.d/
<span class="token function">mkdir</span> CentBak
<span class="token function">mv</span> CentO* CentBak
<span class="token function">wget</span> http://mirrors.163.com/.help/CentOS7-Base-163.repo
<span class="token function">wget</span> https://mirrors.aliyun.com/repo/epel-7.repo
yum clean all <span class="token operator">&amp;&amp;</span> yum makecache <span class="token operator">&amp;&amp;</span> yum update	<span class="token comment"># 删除重建缓存 更新</span></code></pre>
<p><strong>安装依赖</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum -y <span class="token function">install</span> gcc* pcre-devel openssl openssl-devel zlib-devel ncurses-devel cmake bison libxml2-devel libpng-devel sqlite-devel oniguruma oniguruma-devel.x86_64</code></pre>
<p><strong>下载源码包</strong></p>
<p>Nginx：<a
target="_blank" rel="noopener" href="http://nginx.org/en/download.html">http://nginx.org/en/download.html</a></p>
<p>MySQL：<a
target="_blank" rel="noopener" href="https://dev.mysql.com/downloads/mysql/">https://dev.mysql.com/downloads/mysql/</a>
<strong>选择操作系统的时候选择SourceCode而不是RedHat</strong>，选择OS
Versiob的时候选择Generic Linux</p>
<p>PHP：<a
target="_blank" rel="noopener" href="https://www.php.net/downloads">https://www.php.net/downloads</a></p>
<p><strong>Nginx</strong></p>
<p>Nginx是一个轻量高并发的Web服务器/反向代理服务器/邮件服务器</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">tar</span> -xvf nginx-1.18.0.tar.gz
<span class="token builtin class-name">cd</span> nginx-1.18.0
<span class="token comment"># 需要为Nginx创建一个运行的用户</span>
<span class="token function">useradd</span> -r -s /sbin/nologin nginx
<span class="token function">passwd</span> nginx
<span class="token comment"># 检查环境 生成make文件 添加参数：位置 用户 组 状态统计模块 https模块</span>
./configure --prefix<span class="token operator">=</span>/usr/local/nginx --user<span class="token operator">=</span>nginx --group<span class="token operator">=</span>nginx --with-http_stub_status_module --with-http_ssl_module
<span class="token function">make</span>
<span class="token function">make</span> <span class="token function">install</span>
<span class="token comment"># 尝试启动</span>
/usr/local/nginx/sbin/nginx 
<span class="token function">netstat</span> -tulnp</code></pre>
<p><strong>MySQL</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">tar</span> -xvf mysql-boost-8.0.23.tar.gz 
<span class="token builtin class-name">cd</span> mysql-8.0.23/
<span class="token function">useradd</span> -r -s /sbin/nologin mysql
<span class="token function">passwd</span> mysql</code></pre>
<p>注意：我是在CentOS7上安装mysql-boost 8.0.23存在很多问题</p>
<ul>
<li><p>cmake版本为2.8但是mysql要求cmake3</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> -y cmake3</code></pre></li>
<li><p>CentOS7的GCC最高版本为4.8但是mysql要求5.2+，这个库查找源很慢，但是下载很快
耐心等等</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> centos-release-scl			<span class="token comment"># 安装scl扩展库</span>
yum <span class="token function">install</span> devtoolset-7-gcc*			<span class="token comment"># 安装包含gcc7.2的gcc组件库</span>
scl <span class="token builtin class-name">enable</span> devtoolset-7 <span class="token function">bash</span>			<span class="token comment"># 切换scl环境</span>
<span class="token function">which</span> gcc								<span class="token comment"># 验证</span>
gcc --version
<span class="token builtin class-name">export</span> <span class="token assign-left variable">CC</span><span class="token operator">=</span>/usr/local/bin/gcc			<span class="token comment"># 修改加入环境变量</span>
<span class="token builtin class-name">export</span> <span class="token assign-left variable">CXX</span><span class="token operator">=</span>/usr/local/bin/g++</code></pre></li>
<li><p>我选择的是sql-boost，也就是MySQL且带有boost库，这是一个C的扩展库，但是安装前要设置目录</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> -p /usr/local/boost</code></pre></li>
<li><p>编译安装</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> build
<span class="token builtin class-name">cd</span> build
cmake3 <span class="token punctuation">\</span>
-DCMAKE_INSTALL_PREFIX<span class="token operator">=</span>/usr/local/mysql <span class="token punctuation">\</span>
-DMYSQL_UNIX_ADDR<span class="token operator">=</span>/tmp/mysql.sock <span class="token punctuation">\</span>
-DWITH_MEMORY_STORAGE_ENGINE<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
-DWITH_MYISAM_STORAGE_ENGINE<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
-DWITH_INNOBASE_STORAGE_ENGINE<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
-DWITH_READLINE<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
-DDEFAULT_CHARSET<span class="token operator">=</span>utf8 <span class="token punctuation">\</span>
-DDEFAULT_COLLATION<span class="token operator">=</span>utf8_general_ci <span class="token punctuation">\</span>
-DEXTRA_CHARSETS<span class="token operator">=</span>all <span class="token punctuation">\</span>
-DENABLED_LOCAL_INFILE<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
-DMYSQL_USER<span class="token operator">=</span>mysql <span class="token punctuation">\</span>
-DMYSQL_TCP_PORT<span class="token operator">=</span><span class="token number">3306</span> <span class="token punctuation">\</span>
-DFORCE_INSOURCE_BUILD<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
-DWITH_BOOST<span class="token operator">=</span>/usr/local/boost <span class="token punctuation">\</span>
-DDOWNLOAD_BOOST<span class="token operator">=</span><span class="token number">1</span> <span class="token punctuation">\</span>
<span class="token punctuation">..</span>/
<span class="token function">make</span>
<span class="token function">make</span> <span class="token function">install</span></code></pre>
<p>选项分别是</p>
<ul>
<li><code>-DCMAKE_INSTALL_PREFIX</code>：安装目录</li>
<li><code>-DMYSQL_UNIX_ADDR</code>：Unix socket 文件路径</li>
<li><code>-DWITH_MEMORY_STORAGE_ENGINE</code>：安装memory存储引擎</li>
<li><code>-DWITH_MYISAM_STORAGE_ENGINE</code>：安装myisam存储引擎</li>
<li><code>-DWITH_INNOBASE_STORAGE_ENGINE</code>：安装innodb存储引擎</li>
<li><code>-DWITH_READLINE</code>：可以方便的在命令行上面移动，增删，复制，粘贴，搜索</li>
<li><code>-DDEFAULT_CHARSET</code>：使用编码</li>
<li><code>-DDEFAULT_COLLATION</code>：校验字符</li>
<li><code>-DEXTRA_CHARSETS</code>：安装扩展字符集</li>
<li><code>-DENABLED_LOCAL_INFILE</code>：</li>
<li><code>-DMYSQL_USER</code>：默认运行用户</li>
<li><code>-DMYSQL_TCP_PORT</code>：TCP端口号</li>
<li><code>-DFORCE_INSOURCE_BUILD</code>：允许在源码包内编译(即cmake目录在源码文件夹内，默认不允许)</li>
<li><code>-DWITH_BOOST</code>：Boost安装路径</li>
<li><code>-DDOWNLOAD_BOOST</code>：下载Boost</li>
</ul></li>
<li><p>修改目录和权限</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B4 ~<span class="token punctuation">]</span><span class="token comment"># ln -s /usr/local/mysql/bin/* /usr/local/bin/</span>
<span class="token comment"># 修改目录方便操作</span>
<span class="token punctuation">[</span>root@C7B4 ~<span class="token punctuation">]</span><span class="token comment"># cd /usr/local/mysql/</span>
<span class="token punctuation">[</span>root@C7B4 mysql<span class="token punctuation">]</span><span class="token comment"># chown -R root .</span>
<span class="token punctuation">[</span>root@C7B4 mysql<span class="token punctuation">]</span><span class="token comment"># mkdir data</span>
<span class="token punctuation">[</span>root@C7B4 mysql<span class="token punctuation">]</span><span class="token comment"># chown -R mysql data</span></code></pre></li>
<li><p>初始化数据库</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B4 /<span class="token punctuation">]</span><span class="token comment"># cd /usr/local/mysql/</span>
<span class="token punctuation">[</span>root@C7B4 mysql<span class="token punctuation">]</span><span class="token comment"># mkdir mysql_install_db</span>
<span class="token punctuation">[</span>root@C7B4 mysql<span class="token punctuation">]</span><span class="token comment"># chmod 777 ./mysql_install_db</span></code></pre></li>
<li><p>生成启动/自启动</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B4 mysql<span class="token punctuation">]</span><span class="token comment"># cd ~/mysql-8.0.23/support-files/</span>
<span class="token punctuation">[</span>root@C7B4 support-files<span class="token punctuation">]</span><span class="token comment"># cp -a mysql.server.sh /etc/init.d/mysqld</span>
<span class="token punctuation">[</span>root@C7B4 support-files<span class="token punctuation">]</span><span class="token comment"># chmod +x /etc/init.d/mysqld </span></code></pre></li>
</ul>
<p><strong>PHP</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">./configure <span class="token punctuation">\</span>
--prefix<span class="token operator">=</span>/usr/local/php <span class="token punctuation">\</span>
--with-config-file-path<span class="token operator">=</span>/usr/local/php/etc <span class="token punctuation">\</span>
--enable-fpm <span class="token punctuation">\</span>
--enable-sockets <span class="token punctuation">\</span>
--enable-soap <span class="token punctuation">\</span>
--enable-mbstring<span class="token operator">=</span>all <span class="token punctuation">\</span>
--with-mysql<span class="token operator">=</span>/usr/local/mysql/bin/mysql_config <span class="token punctuation">\</span>
--with-pod-mysqli<span class="token operator">=</span>/usr/local/mysql <span class="token punctuation">\</span>
--without-pear
<span class="token function">make</span>
<span class="token function">make</span> <span class="token function">install</span></code></pre>
<p><strong>生成配置文件</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">cp</span> -a php-8.0.3/php.ini-production /usr/local/php/etc/php.ini
<span class="token function">ln</span> -s /usr/local/bin/* /usr/local/bin/
<span class="token function">ln</span> -s /usr/local/sbin/* /usr/local/sbin/</code></pre>
<p>nginx会通过一个php-fpm服务连接到PHP,Nginx会开放80端口，对请求进行判断，如果需要PHP就会使用fastcgi模块连接到PHP-fpm的9000口，PHP-fpm会访问PHP,PHP再访问MySQL，可以如下配置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B4 ~<span class="token punctuation">]</span><span class="token comment"># cd /usr/local/php/etc/</span>
<span class="token punctuation">[</span>root@C7B4 etc<span class="token punctuation">]</span><span class="token comment"># cp -a php-fpm.conf.default php-fpm.conf</span>
<span class="token punctuation">[</span>root@C7B4 etc<span class="token punctuation">]</span><span class="token comment"># vim php-fpm.conf</span>
	pid <span class="token operator">=</span> run/php-fpm.pid
	<span class="token assign-left variable">user</span><span class="token operator">=</span>nginx
	<span class="token assign-left variable">group</span><span class="token operator">=</span>nginx
	pm.start_server<span class="token operator">=</span><span class="token number">2</span>			<span class="token comment"># 开启进程</span>
	pm.min_spare_servers<span class="token operator">=</span><span class="token number">1</span>		<span class="token comment"># 最少空闲</span>
	pm.max_spare_servers<span class="token operator">=</span><span class="token number">3</span>		<span class="token comment"># 最多空闲</span>
<span class="token punctuation">[</span>root@C7B4 etc<span class="token punctuation">]</span><span class="token comment"># vim /usr/local/nginx/conf/nginx.conf	# 取消注释</span>
    location ~ <span class="token punctuation">\</span>.php$ <span class="token punctuation">&#123;</span>
        root           html<span class="token punctuation">;</span>
        fastcgi_pass   <span class="token number">127.0</span>.0.1:9000<span class="token punctuation">;</span>
        fastcgi_index  index.php<span class="token punctuation">;</span>
        fastcgi_param  SCRIPT_FILENAME  /scripts<span class="token variable">$fastcgi_script_name</span><span class="token punctuation">;</span>
        include        fastcgi.conf<span class="token punctuation">;</span>		<span class="token comment"># 修改一下</span>
    <span class="token punctuation">&#125;</span></code></pre>
<p>重启nginx(两个要同时启动)</p>
<p><strong>一键安装：https://lnmp.org/ 为例</strong></p>
<p>去网站下载完整包，解压执行<code>./install.sh lnmp</code>，按照提示操作</p>
<p>之后可以使用管理命令管理了https://lnmp.org/faq/lnmp-status-manager.html</p>
<h2 id="nginx">Nginx</h2>
<h3 id="概念">概念</h3>
<ul>
<li><p>同步与异步</p>
<p>同步：消息发出去之后，调用者要等待调用结果，然后执行后续步骤</p>
<p>异步：消息发出后，调用者不必一直等待返回结果，通常有两种方式</p>
<ul>
<li>主动轮询异步调用结果</li>
<li>通过回调通知的方式获取调用结果</li>
</ul></li>
<li><p>阻塞和非阻塞</p>
<p>阻塞是消息发出后线程挂起，直到消息返回</p>
<p>非阻塞：消息发出后线程正常工作</p></li>
<li><p>大部分程序都是同步阻塞的，无法高并发，Nginx采用了异步非阻塞的epoll模型：当有连接产生时，epoll会告诉进程那个连接有IO事件产生，然后等进程去处理事件，进行遇到函数调用后，不是干坐着等，而是注册一个事件，等函数结果后再运行，期间处理别的线程</p></li>
</ul>
<h3 id="工作模式-1">工作模式</h3>
<ul>
<li><p>支持PHP</p>
<p>Nginx会开放80端口，对请求进行判断，如果需要PHP就会使用fastcgi模块连接到PHP-fpm的9000口，PHP-fpm会访问PHP,PHP再访问MySQL，需要的条件有</p>
<ul>
<li>Nginx支持fastCGI功能(默认支持)</li>
<li>有php-fpm模块支持(安装PHP选项)</li>
<li>配置文件匹配规则</li>
</ul></li>
<li><p>master-worker模式</p>
<p>默认模式，开启后启动一个master和一个worker进程，master管理master进程(启动关闭监控)，worker提供实际上的服务，具有稳定性高，CPU亲和，热部署(<code>pkill -HUP nginx</code>)的优点</p></li>
<li><p>单进程模式</p>
<p>只有一个进程，方便调试，不支持热重启等，一般用于开发</p></li>
</ul>
<h3 id="配置文件结构">配置文件结构</h3>
<p>文件在：<code>/usr/local/nginx/conf/nginx.conf</code>，注意;结尾</p>
<pre class="language-nginx" data-language="nginx"><code class="language-nginx"><span class="token directive"><span class="token keyword">user</span>  www www</span><span class="token punctuation">;</span>					<span class="token comment"># 运行的用户和组</span>

<span class="token directive"><span class="token keyword">worker_processes</span> auto</span><span class="token punctuation">;</span>			<span class="token comment"># 开启的worker进程数量，auto是根据CPU设置</span>
<span class="token directive"><span class="token keyword">worker_cpu_affinity</span> auto</span><span class="token punctuation">;</span>

<span class="token directive"><span class="token keyword">error_log</span>  /home/wwwlogs/nginx_error.log  crit</span><span class="token punctuation">;</span>	<span class="token comment"># 错误日志位置</span>
<span class="token directive"><span class="token keyword">pid</span>        /usr/local/nginx/logs/nginx.pid</span><span class="token punctuation">;</span>		<span class="token comment"># PID文件位置</span>

<span class="token comment">#Specifies the value for maximum file descriptors that can be opened by this process.</span>
<span class="token directive"><span class="token keyword">worker_rlimit_nofile</span> <span class="token number">51200</span></span><span class="token punctuation">;</span>

<span class="token directive"><span class="token keyword">events</span></span>
    <span class="token punctuation">&#123;</span>
        <span class="token directive"><span class="token keyword">use</span> epoll</span><span class="token punctuation">;</span>					<span class="token comment"># 工作模型</span>
        <span class="token directive"><span class="token keyword">worker_connections</span> <span class="token number">51200</span></span><span class="token punctuation">;</span>	
        <span class="token comment"># *一个*工作进程的最大连接数量，和worker_processes相乘就是最发连接数</span>
        <span class="token directive"><span class="token keyword">multi_accept</span> <span class="token boolean">off</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">accept_mutex</span> <span class="token boolean">off</span></span><span class="token punctuation">;</span>
    <span class="token punctuation">&#125;</span>

<span class="token directive"><span class="token keyword">http</span>								<span class="token comment"># 网站参数优化表情</span></span>
    <span class="token punctuation">&#123;</span>
        <span class="token directive"><span class="token keyword">include</span>       mime.types</span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">default_type</span>  application/octet-stream</span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">server_names_hash_bucket_size</span> <span class="token number">128</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">client_header_buffer_size</span> <span class="token number">32k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">large_client_header_buffers</span> <span class="token number">4</span> <span class="token number">32k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">client_max_body_size</span> <span class="token number">50m</span></span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">sendfile</span> <span class="token boolean">on</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">sendfile_max_chunk</span> <span class="token number">512k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">tcp_nopush</span> <span class="token boolean">on</span></span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">keepalive_timeout</span> <span class="token number">60</span></span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">tcp_nodelay</span> <span class="token boolean">on</span></span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">fastcgi_connect_timeout</span> <span class="token number">300</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">fastcgi_send_timeout</span> <span class="token number">300</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">fastcgi_read_timeout</span> <span class="token number">300</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">fastcgi_buffer_size</span> <span class="token number">64k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">fastcgi_buffers</span> <span class="token number">4</span> <span class="token number">64k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">fastcgi_busy_buffers_size</span> <span class="token number">128k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">fastcgi_temp_file_write_size</span> <span class="token number">256k</span></span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">gzip</span> <span class="token boolean">on</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_min_length</span>  <span class="token number">1k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_buffers</span>     <span class="token number">4</span> <span class="token number">16k</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_http_version</span> 1.1</span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_comp_level</span> <span class="token number">2</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_types</span>     text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss</span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_vary</span> <span class="token boolean">on</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_proxied</span>   expired no-cache no-store private auth</span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">gzip_disable</span>   <span class="token string">"MSIE [1-6]\."</span></span><span class="token punctuation">;</span>

        <span class="token comment">#limit_conn_zone $binary_remote_addr zone=perip:10m;</span>
        <span class="token comment">##If enable limit_conn_zone,add "limit_conn perip 10;" to server section.</span>

        <span class="token directive"><span class="token keyword">server_tokens</span> <span class="token boolean">off</span></span><span class="token punctuation">;</span>
        <span class="token directive"><span class="token keyword">access_log</span> <span class="token boolean">off</span></span><span class="token punctuation">;</span>

<span class="token directive"><span class="token keyword">server</span>								<span class="token comment"># 一个server就是一个网站的配置信息(多个server就是虚拟主机了)</span></span>
    <span class="token punctuation">&#123;</span>
        <span class="token directive"><span class="token keyword">listen</span> <span class="token number">80</span> default_server reuseport</span><span class="token punctuation">;</span>				<span class="token comment"># 监听端口</span>
        <span class="token comment">#listen [::]:80 default_server ipv6only=on;</span>
        <span class="token directive"><span class="token keyword">server_name</span> _</span><span class="token punctuation">;</span>									<span class="token comment"># 服务器域名</span>
        <span class="token directive"><span class="token keyword">index</span> index.html index.htm index.php</span><span class="token punctuation">;</span>			<span class="token comment"># 默认加载页面</span>
        <span class="token directive"><span class="token keyword">root</span>  /home/wwwroot/default</span><span class="token punctuation">;</span>					<span class="token comment"># 网站根目录</span>

        <span class="token comment">#error_page   404   /404.html;</span>

        <span class="token comment"># Deny access to PHP files in specific directory</span>
        <span class="token comment">#location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ &#123; deny all; &#125;</span>

        <span class="token directive"><span class="token keyword">include</span> enable-php.conf</span><span class="token punctuation">;</span>

        <span class="token directive"><span class="token keyword">location</span> /nginx_status							<span class="token comment"># 具体请求内容的匹配，诸如域名跳转</span></span>
        <span class="token punctuation">&#123;</span>
            <span class="token directive"><span class="token keyword">stub_status</span> <span class="token boolean">on</span></span><span class="token punctuation">;</span>
            <span class="token directive"><span class="token keyword">access_log</span>   <span class="token boolean">off</span></span><span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span>

        <span class="token directive"><span class="token keyword">location</span> ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$</span>
        <span class="token punctuation">&#123;</span>
            <span class="token directive"><span class="token keyword">expires</span>      <span class="token number">30d</span></span><span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span>

        <span class="token directive"><span class="token keyword">location</span> ~ .*\.(js|css)?$</span>
        <span class="token punctuation">&#123;</span>
            <span class="token directive"><span class="token keyword">expires</span>      <span class="token number">12h</span></span><span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span>

        <span class="token directive"><span class="token keyword">location</span> ~ /.well-known</span> <span class="token punctuation">&#123;</span>
            <span class="token directive"><span class="token keyword">allow</span> all</span><span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span>

        <span class="token directive"><span class="token keyword">location</span> ~ /\.</span>
        <span class="token punctuation">&#123;</span>
            <span class="token directive"><span class="token keyword">deny</span> all</span><span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span>

        <span class="token directive"><span class="token keyword">access_log</span>  /home/wwwlogs/access.log</span><span class="token punctuation">;</span>			<span class="token comment"># 访问日志目录</span>
    <span class="token punctuation">&#125;</span>
<span class="token directive"><span class="token keyword">include</span> vhost/*.conf</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span></code></pre>
<h3 id="状态统计实验">状态统计实验</h3>
<p>基于LNMP一键安装的环境上</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">location /test1
<span class="token punctuation">&#123;</span>
    stub_status on<span class="token punctuation">;</span>				<span class="token comment"># 开启状态统计</span>
    access_log off<span class="token punctuation">;</span>				<span class="token comment"># 不记录日志</span>
<span class="token punctuation">&#125;</span></code></pre>
<p><code>nginx -t</code>检查配置文件，<code>pkill -HUP nginx</code>重启，访问页面，看到</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">Active connections: <span class="token number">2</span> 				<span class="token comment"># 当前连接数</span>
server accepts handled requests		<span class="token comment"># 成功处理的请求</span>
 <span class="token number">8</span> <span class="token number">8</span> <span class="token number">22</span> 							<span class="token comment"># 已处理连接数 成功TCP握手数 已处理请求数</span>
Reading: <span class="token number">0</span> Writing: <span class="token number">1</span> Waiting: <span class="token number">1</span> </code></pre>
<h3 id="目录保护实验">目录保护实验</h3>
<p>修改状态统计配置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">location /test1
<span class="token punctuation">&#123;</span>
    stub_status on<span class="token punctuation">;</span>				<span class="token comment"># 开启状态统计</span>
    access_log off<span class="token punctuation">;</span>				<span class="token comment"># 不记录日志</span>
	auth_basic <span class="token string">"Input Passwd"</span><span class="token punctuation">;</span>
    auth_basic_user_file /usr/local/nginx/html/htpasswd.nginx<span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p>我们需要生成用户文件，但是这个生成目录是htpasswd只有apache有，所以要先安装下apache</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># yum install -y httpd</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># htpasswd -c /usr/local/nginx/html/htpasswd.nginx testuser1</span>
<span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># htpasswd -m /usr/local/nginx/html/htpasswd.nginx testuser2</span></code></pre>
<h3 id="ip验证限制">IP验证限制</h3>
<pre class="language-none"><code class="language-none">location &#x2F;test1
&#123;
    stub_status on;
    access_log off;
    auth_basic &quot;Input Passwd&quot;;
    auth_basic_user_file &#x2F;usr&#x2F;local&#x2F;nginx&#x2F;html&#x2F;htpasswd.nginx;
    allow 10.0.2.15			# 白IP
    deny 10.0.2.0&#x2F;24		# 黑IP
&#125;</code></pre>
<h3 id="虚拟主机实验-1">虚拟主机实验</h3>
<p>使用基于域名的虚拟主机(test1.test.com与test1.test.com)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">server <span class="token punctuation">&#123;</span>
	listen <span class="token number">80</span><span class="token punctuation">;</span>
	server_name test1.test.com<span class="token punctuation">;</span>
	index index.html<span class="token punctuation">;</span>
	root html/test1<span class="token punctuation">;</span>
	access_log logs/test1<span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span>
server <span class="token punctuation">&#123;</span>
	listen <span class="token number">80</span><span class="token punctuation">;</span>
	server_name test2.test.com<span class="token punctuation">;</span>
	index index.html<span class="token punctuation">;</span>
	root html/test2<span class="token punctuation">;</span>
	access_log logs/test2<span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p>在对于目录创建index.html,修改hosts即可</p>
<h3 id="反向代理实验">反向代理实验</h3>
<p>代理与反向代理的区别</p>
<p>代理：代替客户端完成服务，客户端可能无法访问服务器，需要借助其他服务器代替客户完成访问</p>
<p>反向代理：代理服务器进行服务，很多厂商的服务器IP是不会直接暴露在公网的没这是不安全的，可以放一个反向代理服务器，客户端请求反向代理服务器，反向代理服务器向服务端请求,注意，和
跳转不同，他只是转发了请求而不是全部IP直接跳转</p>
<p>在0.65.232.127主机中开启Apache</p>
<p>在Nginx服务器的配置中写入</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">server<span class="token punctuation">&#123;</span>
        listen <span class="token number">80</span><span class="token punctuation">;</span>
        server_name pro.test.com<span class="token punctuation">;</span>
        location /<span class="token punctuation">&#123;</span>
                proxy_pass http://10.65.232.127:80<span class="token punctuation">;</span>
        <span class="token punctuation">&#125;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p>相当于将/pro反向代理到Apache,修改hosts即可</p>
<h3 id="负载均衡">负载均衡</h3>
<p>目前虽然Nginx高效，但是动态页面服务不是很好，我们可以构建多个Apache服务器，让Nginx作反向代理服务器</p>
<p>这里我们做一个rr轮询的负载均衡，相当于轮流将请求发给多个apache</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">upstream serveLake<span class="token punctuation">&#123;</span>						<span class="token comment"># 定义了一个服务器池</span>
        server <span class="token number">10.65</span>.232.127:80<span class="token punctuation">;</span>
        server <span class="token number">10.65</span>.102.181:80<span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span>

server<span class="token punctuation">&#123;</span>									<span class="token comment"># 刚刚的反向代理</span>
        listen <span class="token number">80</span><span class="token punctuation">;</span>
        server_name pro.test.com<span class="token punctuation">;</span>
        location /<span class="token punctuation">&#123;</span>
                proxy_pass http://serveLake<span class="token punctuation">;</span>		<span class="token comment"># 修改目标</span>
                proxy_set_header Host <span class="token variable">$host</span><span class="token punctuation">;</span>		<span class="token comment"># 请求重写头部 否则二级页面无法访问</span>
        <span class="token punctuation">&#125;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p>实现加权rr访问</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">upstream serveLake<span class="token punctuation">&#123;</span>						<span class="token comment"># 定义了一个服务器池</span>
        server <span class="token number">10.65</span>.232.127:80 <span class="token assign-left variable">weight</span><span class="token operator">=</span><span class="token number">1</span><span class="token punctuation">;</span>
        server <span class="token number">10.65</span>.102.181:80 <span class="token assign-left variable">weight</span><span class="token operator">=</span><span class="token number">2</span><span class="token punctuation">;</span>
<span class="token punctuation">&#125;</span></code></pre>
<h3 id="https永久重写">https+永久重写</h3>
<p>在要加密的server中写入(如果你想要全局配置，又不想所有主机都写，可以写如子配置文件然后include文件)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">server
    <span class="token punctuation">&#123;</span>
        ssl on<span class="token punctuation">;</span>
        ssl_certificate /etc/ssl/test.crt<span class="token punctuation">;</span>
        ssl_certificate_key /etc/ssl/test.key<span class="token punctuation">;</span>
        ssl_session_timeout 5m<span class="token punctuation">;</span>
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2<span class="token punctuation">;</span>
        ssl_prefer_server_ciphers on<span class="token punctuation">;</span>
        listen <span class="token number">80</span> default_server reuseport<span class="token punctuation">;</span>
		listen <span class="token number">443</span>						<span class="token comment"># 记得修改端口号</span>
		<span class="token punctuation">..</span>.
	<span class="token punctuation">&#125;</span>
server <span class="token punctuation">&#123;</span>	<span class="token comment"># 设置http跳https</span>
        listen <span class="token number">80</span><span class="token punctuation">;</span>
        server_name _<span class="token punctuation">;</span>
        index index.html<span class="token punctuation">;</span>
        rewrite ^<span class="token punctuation">(</span>.<span class="token punctuation">)</span>*$ https://10.65.103.177 permanent<span class="token punctuation">;</span>		<span class="token comment"># 匹配所有的域名 转发到https 103</span>
<span class="token punctuation">&#125;</span>
</code></pre>
<p>创建证书</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">cd</span> /etc/ssl
openssl genrsa -out test.key <span class="token number">1024</span>
openssl req -new -key test.key -out test.csr
openssl x509 -req -days <span class="token number">365</span> -sha256 -in test.csr -signkey test.key -out test.crt</code></pre>
<h2 id="邮件服务器">邮件服务器</h2>
<h3 id="概述">概述</h3>
<ul>
<li><p>服务器软件：Sendmail(古老稳定
不安全)，Postfix(高效稳定安全兼容性好)，Qmail(高效 配置复杂)</p></li>
<li><p>常见协议</p>
<ul>
<li>SMTP：发邮件TCP25 加密为TCP465</li>
<li>POP3：收邮件TCP110 加密为TCP995</li>
<li>IMAP4：收邮件TCP143 加密TCP993</li>
</ul></li>
<li><p>使用软件：Postfix(预装)</p>
<ul>
<li><p>主目录：/etc/postfix</p></li>
<li><p>配置文件：main.cf</p>
<p>myhostname：服务器主机名</p>
<p>mydomain：邮件域</p>
<p>myorigin：发件时的目标机器白名单域</p>
<p>mydestination：收件的来源服务器白名单域</p></li>
</ul></li>
</ul>
<h3 id="搭建dns">搭建DNS</h3>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> -y <span class="token builtin class-name">bind</span>
<span class="token function">vim</span> /etc/named.conf 
	<span class="token comment"># 修改监听卡为any</span>
<span class="token function">vim</span> /etc/named.rfc1912.zones 
	zone <span class="token string">"extmail.org"</span> IN <span class="token punctuation">&#123;</span>
        <span class="token builtin class-name">type</span> master<span class="token punctuation">;</span>
        <span class="token function">file</span> <span class="token string">"mytestlkr.localhost"</span><span class="token punctuation">;</span>
        allow-update <span class="token punctuation">&#123;</span> none<span class="token punctuation">;</span> <span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
	<span class="token punctuation">&#125;</span><span class="token punctuation">;</span>
<span class="token builtin class-name">cd</span> /var/named/
<span class="token function">cp</span> -R named.localhost mytestlkr.localhost
<span class="token function">vim</span> mytestlkr.localhost
    <span class="token variable">$TTL</span> 1D
    @       IN SOA  extmail.org. rname.invalid. <span class="token punctuation">(</span>
                                            <span class="token number">0</span>       <span class="token punctuation">;</span> serial
                                            1D      <span class="token punctuation">;</span> refresh
                                            1H      <span class="token punctuation">;</span> retry
                                            1W      <span class="token punctuation">;</span> expire
                                            3H <span class="token punctuation">)</span>    <span class="token punctuation">;</span> minimum
            NS      dns.extmail.org.
            MX <span class="token number">3</span>    mail.extmail.org.
    dns     A       <span class="token number">192.168</span>.238.175
    mail    A       <span class="token number">192.168</span>.238.175</code></pre>
<h3 id="配置邮件发送方">配置邮件发送方</h3>
<p>需要mysql存储数据，apache的网页邮箱服务，mailx 启动服务</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> -y gcc* <span class="token function">make</span> mysql-server mysql httpd mailx</code></pre>
<p>extmail和extman是一套成熟的邮件解决方案</p>
<p>解压，放文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> /var/www/extsuit
<span class="token function">tar</span> -xf extmail-1.2.tar.gz -C /var/www/extsuit/
<span class="token function">tar</span> -xf extman-1.1.tar.gz -C /var/www/extsuit/
<span class="token builtin class-name">cd</span> /var/www/extsuit/
<span class="token function">mv</span> extmail-1.2/ extmail
<span class="token function">mv</span> extman-1.1/ extman
<span class="token function">chown</span> -R root.root *
<span class="token comment"># 导入数据库</span>
mysql<span class="token operator">&lt;</span> ./extman/docs/extmail.sql -uroot -p
<span class="token function">vim</span> ./extman/docs/init.sql 
	修改为 VALUES <span class="token punctuation">(</span><span class="token string">'root@extmail.org'</span>,<span class="token string">'123456'</span>,<span class="token string">'admin'</span>,<span class="token string">'root'</span>,<span class="token string">'Super User'</span>,<span class="token string">'my question'</span>,<span class="token string">'my answer'</span>,<span class="token string">'0'</span>,<span class="token string">'2007-02-14 15:10:04'</span>,<span class="token string">'2010-11-08'</span>,1<span class="token punctuation">)</span><span class="token punctuation">;</span>
 mysql <span class="token operator">&lt;</span> ./extman/docs/init.sql</code></pre>
<p>拷贝模板到邮件服务器</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">cd</span> /var/www/extsuite/extman/docs/
<span class="token function">cp</span> -a mysql_virtual_alias_maps.cf mysql_virtual_domains_maps.cf mysql_virtual_mailbox_maps.cf
/etc/postfix/
<span class="token function">useradd</span> -u <span class="token number">600</span> -s /sbin/nologin vmail
<span class="token function">vim</span> /etc/postfix/main.cf
inet_interfaces <span class="token operator">=</span> all
    <span class="token comment">#inet_interfaces = localhost</span>
     <span class="token comment">#将此选项注释掉</span>
	 <span class="token comment"># 在尾部添加下列内容</span>
    virtual_mailbox_base <span class="token operator">=</span> /home/vmail
    virtual_uid_maps <span class="token operator">=</span> static:600
    virtual_gid_maps <span class="token operator">=</span> static:600
    virtual_alias_maps <span class="token operator">=</span> mysql:/etc/postfix/mysql_virtual_alias_maps.cf
    virtual_mailbox_domains <span class="token operator">=</span> mysql:/etc/postfix/mysql_virtual_domains_maps.cf
    virtual_mailbox_maps <span class="token operator">=</span> mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf</code></pre>
<p>重启服务&amp;发送邮件测试&amp;查看结果</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">service</span> postfix restart
<span class="token builtin class-name">echo</span> <span class="token string">"hello"</span> <span class="token operator">|</span> mail -s <span class="token builtin class-name">test</span> support@extmail.org
<span class="token function">ls</span> /home/vmail/extmail.org/postmaster/Maildir/new/</code></pre>
<h3 id="配置接收方">配置接收方</h3>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum -y <span class="token function">install</span> dovecot dovecot-devel dovecot-mysql
<span class="token function">chkconfig</span> dovecot on
<span class="token function">service</span> dovecot start</code></pre>
<p>配置 dovecot 能够去数据库里读数据 -
修改/etc/dovecot/conf.d/10-mail.conf <pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#在配置文件中增加下列两行</span>
mail_location <span class="token operator">=</span> maildir:/home/vmail/%d/%n/Maildir <span class="token comment">#定义 dovecot 查询邮件的位置(顶头写)</span>
first_valid_uid <span class="token operator">=</span> <span class="token number">600</span></code></pre> -
修改/etc/dovecot/conf.d/10-auth.conf <pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token operator">!</span>include auth-sql.conf.ext
 <span class="token comment">#取消调用数据库的记录注释</span></code></pre> -
修改数据库连接配置文件(需要拷贝模板生成) <pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">cp</span> -a /usr/share/doc/dovecot-2.0.9/example-config/dovecot-sql.conf.ext /etc/dovecot/
<span class="token function">vim</span> dovecot-sql.conf.ext
 <span class="token comment">#将下列内容加入配置文件即可</span>
	driver <span class="token operator">=</span> mysql
	驱动类型
	connect <span class="token operator">=</span> <span class="token assign-left variable">host</span><span class="token operator">=</span>localhost <span class="token assign-left variable">dbname</span><span class="token operator">=</span>extmail <span class="token assign-left variable">user</span><span class="token operator">=</span>extmail <span class="token assign-left variable">password</span><span class="token operator">=</span>extmail</code></pre> -
连接数据库的信息 <pre class="language-bash" data-language="bash"><code class="language-bash">default_pass_scheme <span class="token operator">=</span> MD5
password_query <span class="token operator">=</span> <span class="token punctuation">\</span>
SELECT username, domain, password <span class="token punctuation">\</span>
FROM mailbox WHERE username <span class="token operator">=</span> <span class="token string">'%u'</span> AND domain <span class="token operator">=</span> <span class="token string">'%d'</span></code></pre> - 验证登录密码的查询命令
<pre class="language-bash" data-language="bash"><code class="language-bash">user_query <span class="token operator">=</span> SELECT maildir, <span class="token number">600</span> AS uid, <span class="token number">600</span> AS gid FROM mailbox WHERE username <span class="token operator">=</span> <span class="token string">'%u'</span>
<span class="token comment"># 查询虚拟用户对应的邮箱目录</span></code></pre> - 重启 dovecot 验证是否能连接 <pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token comment"># 安装 telnet 客户端进行登录验证</span>
yum -y <span class="token function">install</span> telnet
telnet mail.extmail.org <span class="token number">110</span>
user postmaster@extmail.org
 <span class="token comment">#登录 postmaster 用户</span>
pass extmail
 <span class="token comment">#密码是 extmail</span>
retr <span class="token number">1</span>
 <span class="token comment">#查看第一封邮件</span></code></pre></p>
<h3 id="web客户端">Web客户端</h3>
<ul>
<li>修改/etc/httpd/conf/httpd.conf 配置文件,能加载邮件 web 页面
<pre class="language-bash" data-language="bash"><code class="language-bash">NameVirtualHost *:80
   <span class="token comment"># 取消注释,开启虚拟主机功能</span>
   <span class="token comment"># 添加一下内容</span>
<span class="token operator">&lt;</span>VirtualHost *:8<span class="token operator"><span class="token file-descriptor important">0</span>></span>
DocumentRoot /var/www/extsuite/extmail/html
ServerName mail.extmail.org
scriptalias /extmail/cgi /var/www/extsuite/extmail/cgi
<span class="token builtin class-name">alias</span> /extmail /var/www/extsuite/extmail/html
scriptalias /extman/cgi /var/www/extsuite/extman/cgi
<span class="token builtin class-name">alias</span> /extman /var/www/extsuite/extman/html
suexecusergroup vmail vmail
<span class="token operator">&lt;</span>/VirtualHost<span class="token operator">></span></code></pre></li>
<li>extmail 目录中更改 cgi 的属组属主,让 vmail 有权限执行
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">chown</span> -R vmail.vmail cgi/
<span class="token function">cp</span> -a webmail.cf.default webmail.cf
<span class="token function">vim</span> webmail.cf
	SYS_MAILDIR_BASE <span class="token operator">=</span> /home/vmail
	 <span class="token comment">#邮件存放目录</span>
	SYS_CRYPT_TYPE <span class="token operator">=</span> plain
	 <span class="token comment">#加密类型</span>
	SYS_MYSQL_USER <span class="token operator">=</span> extmail
	 <span class="token comment">#MySQL 用户名</span>
	SYS_MYSQL_PASS <span class="token operator">=</span> extmail
	 <span class="token comment">#MySQL 密码</span></code></pre></li>
<li>extman 中更改 cgi 的属组属主,让 vmail 有权限执行
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">chown</span> -R vmail.vmail cgi/
<span class="token function">cp</span> -a webman.cf.default webman.cf
<span class="token function">vim</span> webman.cf
	SYS_MAILDIR_BASE <span class="token operator">=</span> /home/vmail
	SYS_SESS_DIR <span class="token operator">=</span> /tmp
	SYS_CAPTCHA_ON <span class="token operator">=</span> <span class="token number">0</span>
	 <span class="token comment">#生产环境中开启,实验环境无法显示校验码</span>
	SYS_CRYPT_TYPE <span class="token operator">=</span> plain</code></pre></li>
<li>安装 Unix-Syslog 软件 解压缩 Unix-Syslog-1.1.tar.gz 软件
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">cd</span> Unix-Syslog-1.1
perl Makefile.PL
<span class="token function">make</span>
<span class="token function">make</span> <span class="token function">install</span></code></pre></li>
<li>在浏览器上访问,windows 测试需要手动指向 dns 服务器</li>
</ul>
<h2 id="rsync">Rsync</h2>
<p>在类Unix下的数据备份工具，支持完全与增量备份，支持不同主机之间的复制与原创同步，简单方便，高效，无特殊权限与端口限制，可以识别有选择保留软硬连接，文件属性权限</p>
<p>连接方式有SSH模式与rsync模式，后者不需要系统用户即可登陆</p>
<h3 id="ssh单次备份实验">SSH单次备份实验</h3>
<p>环境要求：一台NFS服务器[模拟正常服务计算机]，一台rsync服务器[模拟备份服务器]均无需提前预装软件</p>
<p>在rsync服务器上建立文件夹filedist，在NFS服务器上创建filesrc文件夹</p>
<p><strong>让备份服务器主动拉取数据</strong></p>
<p>在备份服务器上</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">rsync</span> -avz root@192.168.230.175:/filesrc /filedst</code></pre>
<p>这是一个单次操作，与scp相似，修改位置就可以实现上传与下载了</p>
<p><strong>创建普通用户完成同步</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># useradd zhangsan</span>
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># passwd zhangsan</span>
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># setfacl -m u:zhangsan:rwx /filesrc/		# 修改ACL实现控制</span></code></pre>
<p><strong>免密登陆</strong></p>
<p>配置SSH密钥对即可</p>
<h3 id="rsync单次备份实验">Rsync单次备份实验</h3>
<p>正常服务器中修改<code>/etc/rsyncd.conf</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">address <span class="token operator">=</span> <span class="token number">192.168</span>.230.175				<span class="token comment"># 监听IP</span>
port <span class="token number">873</span>
log <span class="token function">file</span> <span class="token operator">=</span> /var/log/rsyncd.log			<span class="token comment"># 文件位置</span>
pid <span class="token function">file</span> <span class="token operator">=</span> /var/run/rsyncd.pid
<span class="token punctuation">[</span>web<span class="token punctuation">]</span>									<span class="token comment"># 共享名 和Samba一样</span>
        comment <span class="token operator">=</span> <span class="token function">rsync</span> back
        path <span class="token operator">=</span> /filesrc					<span class="token comment"># 路径</span>
        <span class="token builtin class-name">read</span> only <span class="token operator">=</span> no
        dont compress <span class="token operator">=</span> *.gz *.bz2		<span class="token comment"># 什么文件不压缩(压缩文件压缩就没有意义了)</span>
        auth <span class="token function">users</span> <span class="token operator">=</span> user1
        secrets <span class="token function">file</span> <span class="token operator">=</span> /etc/rsyncd_users.db</code></pre>
<p>创建密码文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># vim /etc/rsyncd_users.db</span>
	user1:123456
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># chmod 600 /etc/rsyncd_users.db 	# 必须该权限否则报错</span></code></pre>
<p>启动服务</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># rsync --daemon</span>
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># netstat -antp | grep :873</span>
tcp  <span class="token number">0</span>   <span class="token number">0</span> <span class="token number">192.168</span>.230.175:873     <span class="token number">0.0</span>.0.0:*     LISTEN      <span class="token number">1554</span>/rsync 
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># setfacl -m u:nobody:rwx /filesrc/		# 设置映射用户权限</span></code></pre>
<p><strong>服务器拉取</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">rsync</span> -avz rsync://user1@192.168.230.175/web /filedst/</code></pre>
<p>-avz后还可以加上--delete，可以删除备份服务器有但是源文件服务器没有的</p>
<p><strong>服务器推送</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">rsync</span> -avz /filedst/ rsync://user1@192.168.230.175/web </code></pre>
<p>注意，这里只有本地开了rsync服务，所以只能进行服务器端的拉取与推送</p>
<p><strong>免密登陆</strong></p>
<p>客户端设置环境变量<code>RSYNC_PASSWD=虚拟密码</code></p>
<h3 id="rsyncinotify实时同步">Rsync+inotify实时同步</h3>
<p>定期同步时间固定，延时大，存在资源浪费</p>
<p>inotify
是一个Linux的内核特性，监控文件系统，在文件发生(包括属性)变化后会想设置的程序警告，有两个inotify，inotifywait和inotifywait，前者实时输出监控结果，后者在任务完成后才输出，我们选择前者</p>
<p>安装(源服务器端)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> epel-release
yum <span class="token function">install</span> gcc* inotify-tools</code></pre>
<p>监控语法</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">inotifywait -mrq -e 监控动作1,监控动作2,监控动作3 监控位置 <span class="token operator">&amp;</span></code></pre>
<p><code>-m</code>：始终保持事件监听</p>
<p><code>-r</code>：递归查询目录</p>
<p><code>-q</code>：打印监控信息</p>
<p><code>-e</code>：手动指定监听哪些事件(modify,create,move,delete,attrib(权限修改))，不写就是所有事件</p>
<p><code>&amp;</code>：后台运行</p>
<p>测试</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 yum.repos.d<span class="token punctuation">]</span><span class="token comment"># inotifywait -mrq -e create,delete,modify /filesrc &amp;</span>
<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span> <span class="token number">1772</span>
<span class="token punctuation">[</span>root@C7B1 yum.repos.d<span class="token punctuation">]</span><span class="token comment"># cd /filesrc/</span>
<span class="token punctuation">[</span>root@C7B1 filesrc<span class="token punctuation">]</span><span class="token comment"># touch 123</span>
/filesrc/ CREATE <span class="token number">123</span>					<span class="token comment"># inotifu的信息</span></code></pre>
<p>编写脚本,修改+x</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token shebang important">#!/bin/bash</span>
<span class="token assign-left variable">a</span><span class="token operator">=</span><span class="token string">"inotifywait -mrq -e create,delete,modify /filesrc"</span>		<span class="token comment"># 同步监控命令</span>
<span class="token assign-left variable">b</span><span class="token operator">=</span><span class="token string">"rsync -avz /filesrc root@192.168.230.189:/filedst"</span>		<span class="token comment"># 推送命令</span>
<span class="token variable">$a</span> <span class="token operator">|</span> <span class="token keyword">while</span> <span class="token builtin class-name">read</span> directory event <span class="token function">file</span>			<span class="token comment"># 开始监控，不管有没有问题直接吧结果推到while(甚至是空结果)，while做一个特殊语法的判定，判定是不是一个文件发生变化的事件，如果是就推送</span>
<span class="token keyword">do</span>
        <span class="token variable">$b</span>
<span class="token keyword">done</span></code></pre>
<p>设置自动登陆与运行</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">ssh-keygen -t rsa -b <span class="token number">2048</span>
ssh-copy-id root@192.168.230.189
~/test.sh <span class="token operator">&amp;</span></code></pre>
<h3
id="unisoninotify实现双向数据同步">unison+inotify实现双向数据同步</h3>
<p>inotify部署两个可以实现双向，但是不好用，双向甚至不用使用unison，但是低效</p>
<p><strong>环境准备</strong></p>
<ul>
<li><p>双向SSH免密登陆</p></li>
<li><p>双向安装软件</p>
<pre class="language-none"><code class="language-none">yum install epel-release
yum install gcc* inotify-tools unison ocaml</code></pre></li>
<li><p>部署脚本</p>
<p>源服务器</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token shebang important">#!/bin/bash</span>
<span class="token assign-left variable">a</span><span class="token operator">=</span><span class="token string">"inotifywait -mrq -e create,delete,modify /filesrc"</span>		<span class="token comment"># 同步监控命令</span>
<span class="token assign-left variable">b</span><span class="token operator">=</span><span class="token string">"unison -batch /filesrc root@192.168.230.189:/filedst"</span>	<span class="token comment"># 推送命令</span>
<span class="token variable">$a</span> <span class="token operator">|</span> <span class="token keyword">while</span> <span class="token builtin class-name">read</span> directory event <span class="token function">file</span>			<span class="token comment"># 开始监控，不管有没有问题直接吧结果推到while(甚至是空结果)，while做一个特殊语法的判定，判定是不是一个文件发生变化的事件，如果是就推送</span>
<span class="token keyword">do</span>
        <span class="token variable">$b</span>
<span class="token keyword">done</span></code></pre>
<p>备份服务器端</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token shebang important">#!/bin/bash</span>
<span class="token assign-left variable">a</span><span class="token operator">=</span><span class="token string">"inotifywait -mrq -e create,delete,modify /filedst"</span>		<span class="token comment"># 同步监控命令</span>
<span class="token assign-left variable">b</span><span class="token operator">=</span><span class="token string">"unison -batch /filedst root@192.168.230.185:/filesrc"</span>	<span class="token comment"># 推送命令</span>
<span class="token variable">$a</span> <span class="token operator">|</span> <span class="token keyword">while</span> <span class="token builtin class-name">read</span> directory event <span class="token function">file</span>			<span class="token comment"># 开始监控，不管有没有问题直接吧结果推到while(甚至是空结果)，while做一个特殊语法的判定，判定是不是一个文件发生变化的事件，如果是就推送</span>
<span class="token keyword">do</span>
        <span class="token variable">$b</span>
<span class="token keyword">done</span></code></pre></li>
</ul>
<h2 id="javaweb环境搭建">JavaWeb环境搭建</h2>
<p>软件：Nginx/Apache + tomcat + JDK + MySQL</p>
<p>严格的说tomcat是Apache的子项目，JDK用来渲染JavaWeb页面，相当于PHP，tomcat虽然是Apache的一个扩展，但是是一个独立的进程连接到JDK，JDK可以链接到MySQL</p>
<p>我们尝试不知一个Nginx,Tomcat,JDK,MySQL的环境，Nginx在80负责反向代理，将请求发送到Tomcat的8080口，之后Tomcat请求JDK进行页面的渲染，JDK调用MySQL</p>
<h3 id="安装jdk">安装JDK</h3>
<p>我们采用源码安装JDK</p>
<p><strong>下载源码包</strong>：https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html</p>
<p>选择平台，tar.gz包 scp传输过去，解压
移动解压文件到/usr/local，配置环境变量</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">tar</span> -xvf jdk-8u281-linux-x64.tar.gz 
<span class="token function">mv</span> jdk1.8.0_281 /usr/local/jdk1.8
<span class="token function">vim</span> /etc/profile
	<span class="token builtin class-name">export</span> <span class="token assign-left variable">JAVA_HOME</span><span class="token operator">=</span>/usr/local/jdk1.8
    <span class="token builtin class-name">export</span> <span class="token assign-left variable">JAVA_BIN</span><span class="token operator">=</span>/usr/local/jdk1.8/bin
    <span class="token builtin class-name">export</span> <span class="token assign-left variable"><span class="token environment constant">PATH</span></span><span class="token operator">=</span><span class="token environment constant">$PATH</span><span class="token builtin class-name">:</span><span class="token variable">$JAVA_HOME</span>/bin
    <span class="token builtin class-name">export</span> <span class="token assign-left variable">CLASSPATH</span><span class="token operator">=</span>.:<span class="token variable">$JAVA_HOME</span>/lib/dt.jar:<span class="token variable">$JAVA_HOME</span>/lib/tools.jar
<span class="token builtin class-name">source</span> /etc/profile</code></pre>
<h3 id="安装tomcat">安装Tomcat</h3>
<p>下载对应版本的Tomcat：https://tomcat.apache.org/download-80.cgi
不要下src包!!!</p>
<p>解压到/usr/local/bin</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> -p /usr/local/tomcat
<span class="token function">tar</span> -zxvf apache-tomcat-8.5.64.tar.gz -C /usr/local/tomcat
<span class="token function">vim</span> /etc/profile								<span class="token comment"># 修改环境变量</span>
	<span class="token builtin class-name">export</span> <span class="token assign-left variable">TOMCAT_HOME</span><span class="token operator">=</span>/usr/local/tomcat
	<span class="token builtin class-name">export</span> <span class="token assign-left variable"><span class="token environment constant">PATH</span></span><span class="token operator">=</span><span class="token environment constant">$PATH</span><span class="token builtin class-name">:</span><span class="token variable">$TOMCAT_HOME</span>/bin				
<span class="token builtin class-name">source</span> /etc/profile							
<span class="token function">chmod</span> +x /usr/local/tomcat/bin/*				<span class="token comment"># 加入执行权限</span>
/usr/local/tomcat/bin/catalina.sh start			<span class="token comment"># 启动</span></code></pre>
<p>x86_64.tar.gz drwxr-xr-x 11 root root 237 4月 5 20:33
logstash-6.2.3ELK日志分析系统</p>
<p>一种实时日志监控分析工具，支持集群。一般来说，我们可以grep查看一些日志的重要内容，但是低效，我们希望对日志进行集中化管理，分析。</p>
<p>我们希望其具有一些功能</p>
<ul>
<li>可以收集多软件日志</li>
<li>可以稳定传输到管理端</li>
<li>高效存储日志</li>
<li>支持UI分析</li>
<li>支持日志警告与错误报告机制</li>
</ul>
<h2 id="elk平台搭建">ELK平台搭建</h2>
<p>ELK是三个开源软件的缩写：Elasticsearch，Logstash，Kibana，Logstash又有FileBeta进行资源收集</p>
<ul>
<li>Elasticsearch：负责对数据进行搜索分析和存储，具有分布式 零配置
自动分析的特点</li>
<li>Logstash：负责在服务器端将收集的日志进行过滤与修改</li>
<li>Kibana：提供Web的日志分析界面</li>
<li>FileBeta：负责在被收集服务器上收集传输和存储日志</li>
</ul>
<h3 id="实验部署">实验部署</h3>
<p>客户端：FileBeta</p>
<p>服务端：Elasticsearch，Logstash，Kibana</p>
<p>客户访问Nginx后，Nginx记录访问日志，FileBeta将访问日志收集通过LogStash的5044上传日志，LogStash将日志通过9200上传到本机的ElasticSearch，维护人员通过服务端Kibana的5601口查看日志，Kibana通过9200口访问ElasticSearch</p>
<p><strong>服务器配置</strong></p>
<ul>
<li><p>虚拟机内存调整到4G！否则Java没法alloce空间</p></li>
<li><p>服务器下载三软件</p>
<p>https://artifacts.elastic.co/downloads/kibana/kibana-6.2.3-linux-x86_64.tar.gz</p>
<p>https://artifacts.elastic.co/downloads/logstash/logstash-6.2.3.tar.gz</p>
<p>https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.3.tar.gz</p>
<p>解压软件，修改所有者root</p>
<p>复制解压文件到/usr/local</p></li>
<li><p>安装JDK 软件版本原因，请安装yum源的jdk-1.8*</p></li>
<li><p>配置Elasticsearch</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B2 ~<span class="token punctuation">]</span><span class="token comment"># useradd elasticsearch			# 新建一个普通用户elasticsearch</span>
<span class="token punctuation">[</span>root@C7B2 ~<span class="token punctuation">]</span><span class="token comment"># chown -R elasticsearch.elasticsearch /usr/local/elasticsearch-6.2.3/</span>
<span class="token punctuation">[</span>root@C7B2 ~<span class="token punctuation">]</span><span class="token comment"># su - elasticsearch				# 登陆到普通用户</span>
<span class="token punctuation">[</span>elasticsearch@C7B2 ~<span class="token punctuation">]</span>$ <span class="token builtin class-name">cd</span> /usr/local/elasticsearch-6.2.3/
<span class="token punctuation">[</span>elasticsearch@C7B2 elasticsearch-6.2.3<span class="token punctuation">]</span>$ ./bin/elasticsearch -d	<span class="token comment"># 启动</span>
<span class="token punctuation">[</span>elasticsearch@C7B2 elasticsearch-6.2.3<span class="token punctuation">]</span>$ <span class="token function">netstat</span> -antp		<span class="token comment"># 看到9200开启</span></code></pre></li>
<li><p>配置LogStash</p>
<p>回到root,
配置LogStash的日志正则解析，我们希望解析Nginx默认的main格式，于是根据nginx配置文件中的格式写出正则</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"> <span class="token punctuation">[</span>root@C7B2 ~<span class="token punctuation">]</span><span class="token comment"># vim /usr/local/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/grok-patterns </span>
 	<span class="token comment"># 在最后追加</span>
 	WZ <span class="token punctuation">(</span><span class="token punctuation">[</span>^ <span class="token punctuation">]</span>*<span class="token punctuation">)</span>
 	NGINXACCESS %<span class="token punctuation">&#123;</span>IP:remote_ip<span class="token punctuation">&#125;</span> <span class="token punctuation">\</span>- <span class="token punctuation">\</span>- <span class="token punctuation">\</span><span class="token punctuation">[</span>%<span class="token punctuation">&#123;</span>HTTPDATE:timestamp<span class="token punctuation">&#125;</span><span class="token punctuation">\</span><span class="token punctuation">]</span> <span class="token string">"%&#123;WORD:method&#125; %&#123;WZ:request&#125;
 	HTTP/%&#123;NUMBER:httpversion&#125;"</span> %<span class="token punctuation">&#123;</span>NUMBER:status<span class="token punctuation">&#125;</span> %<span class="token punctuation">&#123;</span>NUMBER:bytes<span class="token punctuation">&#125;</span> %<span class="token punctuation">&#123;</span>QS:referer<span class="token punctuation">&#125;</span> %<span class="token punctuation">&#123;</span>QS:agent<span class="token punctuation">&#125;</span>
%<span class="token punctuation">&#123;</span>QS:xforward<span class="token punctuation">&#125;</span></code></pre>
<p>创建配置文件<code>/usr/local/logstash-6.2.3/default.conf</code></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">  input <span class="token punctuation">&#123;</span>					<span class="token comment"># 数据入口 就是监听端口</span>
   beats <span class="token punctuation">&#123;</span>
   port <span class="token operator">=</span><span class="token operator">></span> <span class="token string">"5044"</span>			<span class="token comment"># 监听端口</span>
   <span class="token punctuation">&#125;</span>
  <span class="token punctuation">&#125;</span>
  <span class="token comment">#数据过滤</span>
  filter <span class="token punctuation">&#123;</span>
   grok <span class="token punctuation">&#123;</span>
   match <span class="token operator">=</span><span class="token operator">></span> <span class="token punctuation">&#123;</span> <span class="token string">"message"</span> <span class="token operator">=</span><span class="token operator">></span> <span class="token string">"%&#123;NGINXACCESS&#125;"</span> <span class="token punctuation">&#125;</span>	<span class="token comment"># 使用我们自定义的格式</span>
   <span class="token punctuation">&#125;</span>
   geoip <span class="token punctuation">&#123;</span>
   <span class="token builtin class-name">source</span> <span class="token operator">=</span><span class="token operator">></span> <span class="token string">"192.168.26.175"</span>					<span class="token comment"># Nginx服务器IP</span>
   <span class="token punctuation">&#125;</span>
  <span class="token punctuation">&#125;</span>
  <span class="token comment">#输出配置为本机的 9200 端口，这是 ElasticSerach 服务的监听端口</span>
  output <span class="token punctuation">&#123;</span>
   elasticsearch <span class="token punctuation">&#123;</span>
   hosts <span class="token operator">=</span><span class="token operator">></span> <span class="token punctuation">[</span><span class="token string">"127.0.0.1:9200"</span><span class="token punctuation">]</span>
   <span class="token punctuation">&#125;</span>
<span class="token punctuation">&#125;</span></code></pre>
<p>后台启动：<code>nohup bin/logstash -f default.conf &amp;</code>
查看启动日志：<code>tailf nohup.out</code>
查看端口是否启动：<code>netstat -napt|grep 5044</code></p></li>
<li><p>配置kibana</p>
<p>修改/usr/local/kibana-6.2.3-linux-x86_64/config/kibana.yml文件</p>
<pre class="language-diff" data-language="diff"><code class="language-diff"><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> # server.host: "localhost"
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> server.host: "192.168.36.189"		# 修改为日志服务器IP</span></span></code></pre>
<p>执行启动命令<code>nohup bin/kibana &amp;</code>
查看启动日志:<code>tail -f nohup.out</code>
查看端口是否启动:<code>netstat -napt|grep 5601</code></p></li>
</ul>
<p><strong>被监控客户端配置</strong></p>
<ul>
<li><p>下载软件包，解压到/usr/local/</p>
<p>https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.3-linux-x86_64.tar.gz</p></li>
<li><p>配置/usr/local/filebeat-6.2.3-linux-x86_64/filebeat.yml</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">enable:false
 <span class="token comment">#修改为 true</span>
paths:/var/log/*.log
 <span class="token comment">#修改为/var/log/nginx/*.log</span>
<span class="token comment">#output.elasticsearch:</span>
 <span class="token comment">#将此行注释掉</span>
<span class="token comment">#hosts: ["localhost:9200"]</span>
 <span class="token comment">#将此行注释掉</span>
output.logstash:
 <span class="token comment">#取消此行注释</span>
hosts: <span class="token punctuation">[</span><span class="token string">"192.168.88.100:5044"</span><span class="token punctuation">]</span> <span class="token comment">#取消此行注释并修改 IP 地址为 ELK 服务器地址</span></code></pre></li>
<li><p>启动</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">cd</span> /usr/local/filebeat-6.2.3-linux-x86_64
<span class="token function">nohup</span> ./filebeat -e -c filebeat.yml <span class="token operator">&amp;</span>		<span class="token comment"># 后台启动</span>
tailf nohup.out								<span class="token comment"># 查看日志</span></code></pre></li>
</ul>
<p><strong>访问监控服务端:5601即可</strong></p>
<h2 id="关系型数据库平台mysql">关系型数据库平台(MySQL)</h2>
<p>DBMS统一管理磁盘上的数据，用户不用了解数据库上的实现，降低了数据库的冗余度，提供了便利。DBMS以数据为单位进行共享，具有数据的并发访问能力，具有较好的一致性，延时低，在大规模访问的时候表现远远优于文件系统，DBMS支持事物操作，一个数据的操作要么完成，要么全部不完成</p>
<p><strong>数据库的类型</strong></p>
<ul>
<li><p><strong>关系型数据库</strong>：建立在关系模型上面，借助集合代数的数学方法来处理数据的数据库，现实中的实体群使用关系模型来表示，简单说，关系型数据库就是由多张相互链接的二维行列表格组成的数据库</p>
<p><strong>关系模型</strong>指的是二维表格模型，关系型数据库就是由二维表及其联系组成的一个数据组织</p>
<p><strong>实体关系模型</strong>：简称E-R模型，是一个数据库设计工具，使用图形的方式表示数据库的概念设计，有助于设计过程中的沟通与讨论</p></li>
<li><p><strong>非关系型数据库</strong>：一种轻量，不兼容SQL的数据库，不强调关系，强调Key-Value存储的特点</p></li>
</ul>
<h3 id="关系型数据库理论基础">关系型数据库理论基础</h3>
<p><strong>发展历程</strong></p>
<ul>
<li>层次模型：将实体关系作为边，构成树，但是很不利于进行跨类型的查找</li>
<li>网状模型：实现了跨类型的检索，但是十分不利于数据库的实现</li>
<li>关系模型：以二维表结构定义了关系模型，每个二维表又叫一个关系，关系不需要使用指针链接，关系模式不是孤立的，是通过相同的熟悉进行连接的</li>
</ul>
<p><strong>名词解释</strong></p>
<ul>
<li>记录：数据库中的一行，一般记录一条信息</li>
<li>字段：数据库中的一列，记录同类型的数据，具有一定的数据约束</li>
<li>数据类型(字段的存储规则，决定了字段的宽度，存储方式)
<ul>
<li>字符串类型(CHAR 为0-255的<strong>固定</strong>长度，VARCHAR
0-255的可变长度类型)</li>
<li>数值类型(INT,FLOAT...)</li>
<li>日期和时间类型(DATE表示年月日，TIME表示时分秒)</li>
</ul></li>
</ul>
<p><strong>MySQL约束类型</strong></p>
<p>通过对MySQL数据库的<strong>行</strong>/列的数据做出限制，确保数据的完整和唯一性</p>
<ul>
<li>主键约束：唯一约束+非空约束的组合，主键约束不能重复，不能空，一个表只能有一个主键约束，允许在列级别创建这个列的主键约束，系统会自动在这个列组合上创建索引</li>
<li>外键约束：在多个表之间互为参照关系</li>
<li>唯一约束：列或者<strong>列的组合</strong>不能重复，保证数据库的唯一性，不得出现重复值，但是可以出现多个NULL值，一个表中可以出现多个唯一约束，多个表也可以创建一个唯一约束组合</li>
<li>非空约束：确保列的值不是空值，非空约束只能出现在表对象上，空值NULL可以是所有数据类型，包括INT,FLOAT...，与默认值</li>
</ul>
<p><strong>MySQL索引</strong></p>
<p>索引是一个单独的结构，在我们设置一列或者列组合为一个主键后，MySQL会把这些数据复制一份出来，做一个新表以提高数据的检索效率，当我们进行查询的时候，MySQL会在新表中查询，找到后回会原始数据表中查询，建立合理的索引可以加速数据的检索过程</p>
<p><strong>MySQL锁</strong></p>
<p>是一个允许多用户使用的共享资源，当多用户并发存取资源的时候，数据可能会存在一定的破坏或者错误，加锁实现了数据库的并发控制，加锁后事务就对数据对象有了一定的控制，在事务释放锁之前其他事务不能对数据对象进行更新</p>
<p><strong>MySQL的存储引擎</strong></p>
<p>将库表记录存储为文件，建立索引，更新查询数据的实现</p>
<p>MySQL提供了插件式的存储引擎，可以自己选择，常见的有</p>
<ul>
<li>MYISAM：默认引擎，速度快，支持全文索引，不支持事务，记录锁，不支持外键约束</li>
<li>INNODB：支持事务，记录锁，外键约束</li>
<li>MEMORY：工作在内存中，使用散列字段保存数据，速度快，不能永久保留数据，需要持久化方法</li>
</ul>
<p><strong>事务</strong>：并发控制的基本单位，可以将一系列操作定义为一个事务，事务要么完全完成，要么完全不完成，只有INNODB支持事务管理</p>
<h3 id="mysql基础信息">MySQL基础信息</h3>
<p><strong>常见版本</strong>：</p>
<ul>
<li>Community Server：社区版本，开源免费</li>
<li>Enterprise Edition：企业版本</li>
<li>Cluster：集群版，开源免费，支持将多个集群MySQL封装成一个MySQL</li>
<li>Cluster CGE：高级集群版，付费</li>
</ul>
<p><strong>安装：</strong></p>
<p>源码安装参见：LNMP-环境搭建</p>
<p>以下环境为LNMP一键搭建命令搭建结果</p>
<p><strong>位置：</strong></p>
<p>服务名：mysqld</p>
<p>端口：3306</p>
<p>配置文件：/etc/my.cnf (这个是系统默认存在的，需要安装后覆盖)</p>
<p>初始化脚本：用来生成首次登陆时用户验证表 mysql_install_db</p>
<p>启动命令：默认的常用的是mysqld_safe如果有其他需求可以使用其他目录</p>
<p>数据目录：/var/lib/mysql（yum）</p>
<p>套接字文件：/var/lib/mysql/mysql.sock（yum），源码安装的话一般安装在tmp下，给x权限，否则无法生成</p>
<p>进程文件：/var/run/mysqld/mysqld.pid
(断电重启后需要删除这个文件，否则系统显示启动但是没启动)</p>
<h3 id="mysql基础命令">MySQL基础命令</h3>
<ul>
<li><p>设置初始化密码</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">/usr/local/mysql/bin/mysqladmin -uroot password <span class="token number">123456</span></code></pre></li>
<li><p>登录</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysql <span class="token punctuation">[</span>-u用户名 -p密码<span class="token punctuation">]</span> <span class="token punctuation">[</span>-h登陆位置<span class="token punctuation">]</span>  <span class="token punctuation">[</span>-P 端口<span class="token punctuation">]</span> <span class="token punctuation">[</span>-S 套接字文件位置<span class="token punctuation">]</span></code></pre>
<p>这里的-u用户名,-p密码最好连写 否则可能会识别成要连接的库</p></li>
<li><p>查看MySQL的启用的配置文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>root@C7B1 ~<span class="token punctuation">]</span><span class="token comment"># mysql --help | grep "my.cnf"</span></code></pre></li>
<li><p>登陆后创建用户</p>
<p>MySQL的root权限很大，与Linux的root一样，不建议在root上直接操作，最好创建普通用户</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; create user liukairui@&#39;%&#39; identified by &#39;123456&#39;;</code></pre>
<p>create user 用户名@'允许登陆的地址' identitified by
'密码'，允许登录的地址可以是只允许服务器本地登录'localhost'，任意远程地址'%'，某个网段'192.168.20.%'</p></li>
<li><p>显示所有有权限的数据库</p></li>
</ul>
<p><pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)</code></pre></p>
<ul>
<li><p>用户为自己修改密码</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; set password&#x3D;password(&#39;123456&#39;);</code></pre></li>
<li><p>root用户修改别人的密码</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; set password for liukairui@&#39;%&#39; &#x3D;password(&#39;123456&#39;);</code></pre></li>
<li><p>root用户找回密码</p>
<p>修改配置文件，在<code>[mysqld]</code>下加入<code>skip-grant-tables</code>，意思是跳过检查授权表，重启MySQL服务，使用<code>mysql -uroot</code>登陆即可，进入后修改密码即可，然后删除跳过检查指令</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; update mysql.user set password&#x3D;password(&quot;123456&quot;) where user&#x3D;&#39;root&#39;;</code></pre></li>
<li><p>创建与查询数据库</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; create database web;
mysql&gt; show databases;</code></pre></li>
<li><p>选择数据库 创建数据表</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; use web;									# 选定数据库
Database changed
mysql&gt; create table A1(id int,name char(30));	# 创建数据表
Query OK, 0 rows affected (0.02 sec)
mysql&gt; describe A1;								# 查询数据表
+-------+----------+------+-----+---------+-------+
| Field | Type     | Null | Key | Default | Extra |
+-------+----------+------+-----+---------+-------+
| id    | int(11)  | YES  |     | NULL    |       |
| name  | char(30) | YES  |     | NULL    |       |
+-------+----------+------+-----+---------+-------+
2 rows in set (0.00 sec)
mysql&gt; create table A2(							# 创建一个复杂的数据表
    -&gt; id int unsigned not null auto_increment,
    -&gt; name char(30) not null default &#39;&#39;,
    -&gt; age int not null default 0,
    -&gt; primary key(id));
Query OK, 0 rows affected (0.02 sec)</code></pre></li>
<li><p>插入数据</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; use web							# 选择数据库
Database changed
mysql&gt; insert into A2(id,name,age) values(1,&#39;zhangsan&#39;,30);
	#  插入到		数据表 要插入的字段  值	  插入的值，字符串要引号
Query OK, 1 row affected (0.01 sec)
mysql&gt; select * from A2;
+----+----------+-----+
| id | name     | age |
+----+----------+-----+
|  1 | zhangsan |  30 |
+----+----------+-----+
1 row in set (0.00 sec)
mysql&gt; insert into A2 values(2,&#39;zhang423&#39;,12);		# 不写字段 顺序插入
mysql&gt; insert into A2 values(3,&#39;zhangdd3&#39;);			# 不合法的输入
# ERROR 1136 (21S01): Column count doesn&#39;t match value count at row 1
mysql&gt; insert into A2 values(4,&#39;zhang4&#39;,1),(5,&#39;li5&#39;,67);	# 插入多个
mysql&gt; select * from A2
    -&gt; ;
+----+----------+-----+
| id | name     | age |
+----+----------+-----+
|  1 | zhangsan |  30 |
|  2 | zhang423 |  12 |
|  4 | zhang4   |   1 |
|  5 | li5      |  67 |
+----+----------+-----+
4 rows in set (0.00 sec)</code></pre></li>
<li><p>复制表</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; create table A3(aa varchar(30),bb varchar(30),cc varchar(30));
# 随意创建一个A3表
mysql&gt; insert into A3 select * from A2;			# 把A2中查到的所有内容添加到A3
mysql&gt; select * from A3;
+------+----------+------+
| aa   | bb       | cc   |
+------+----------+------+
| 1    | zhangsan | 30   |
| 2    | zhang423 | 12   |
| 4    | zhang4   | 1    |
| 5    | li5      | 67   |
+------+----------+------+
4 rows in set (0.00 sec)</code></pre></li>
<li><p>删除数据库或数据表</p></li>
</ul>
<p><pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; drop table A1;
mysql&gt; show tables;
+---------------+
| Tables_in_web |
+---------------+
| A2            |
| A3            |
+---------------+
2 rows in set (0.00 sec)
mysql&gt; drop database web;
mysql&gt; show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)
mysql&gt; show tables;
ERROR 1046 (3D000): No database selected</code></pre></p>
<ul>
<li><p>删除记录</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; delete from A1 where age&#x3D;1;
mysql&gt; delete from A1 where age between 3 and 5;</code></pre></li>
<li><p>修改数据</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; select * from A1;
+------+-------+-------+
| id   | name  | age   |
+------+-------+-------+
| 3    | das   |     1 |
| 1    | a1    |     5 |
| 7    | a71   | 34675 |
| 6    | 234a1 |    55 |
| 2    | a41   |    35 |
| 3    | a41   |    25 |
| 4    | a1    |    53 |
+------+-------+-------+
7 rows in set (0.00 sec)
mysql&gt; update A1 set name&#x3D;&#39;testok&#39; where age&#x3D;55;
mysql&gt; select * from A1;
+------+--------+-------+
| id   | name   | age   |
+------+--------+-------+
| 3    | das    |     1 |
| 1    | a1     |     5 |
| 7    | a71    | 34675 |
| 6    | testok |    55 |
| 2    | a41    |    35 |
| 3    | a41    |    25 |
| 4    | a1     |    53 |
+------+--------+-------+
7 rows in set (0.00 sec)</code></pre></li>
<li><p>修改表名</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; alter table A1 rename Atest ;
Query OK, 0 rows affected (0.00 sec)

mysql&gt; show tables;
+---------------+
| Tables_in_web |
+---------------+
| Atest         |
+---------------+
1 row in set (0.00 sec)</code></pre></li>
<li><p>修改字段<strong>类型</strong></p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; alter table Atest modify name char(99);
Query OK, 7 rows affected (0.02 sec)
Records: 7  Duplicates: 0  Warnings: 0

mysql&gt; describe Atest;
+-------+----------+------+-----+---------+-------+
| Field | Type     | Null | Key | Default | Extra |
+-------+----------+------+-----+---------+-------+
| id    | char(30) | YES  |     | NULL    |       |
| name  | char(99) | YES  |     | NULL    |       |
| age   | int(11)  | YES  |     | NULL    |       |
+-------+----------+------+-----+---------+-------+
3 rows in set (0.00 sec)</code></pre></li>
<li><p>修改字段详情(包括字段名，类型，非空等属性)</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; alter table Atest change name mname char(99) not null;
Query OK, 7 rows affected (0.02 sec)
Records: 7  Duplicates: 0  Warnings: 0

mysql&gt; describe Atest;
+-------+----------+------+-----+---------+-------+
| Field | Type     | Null | Key | Default | Extra |
+-------+----------+------+-----+---------+-------+
| id    | char(30) | YES  |     | NULL    |       |
| mname | char(99) | NO   |     | NULL    |       |
| age   | int(11)  | YES  |     | NULL    |       |
+-------+----------+------+-----+---------+-------+
3 rows in set (0.00 sec)</code></pre></li>
<li><p>添加字段</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; alter table Atest add testcol int;
Query OK, 7 rows affected (0.02 sec)
Records: 7  Duplicates: 0  Warnings: 0

mysql&gt; describe Atest;
+---------+----------+------+-----+---------+-------+
| Field   | Type     | Null | Key | Default | Extra |
+---------+----------+------+-----+---------+-------+
| id      | char(30) | YES  |     | NULL    |       |
| mname   | char(99) | NO   |     | NULL    |       |
| age     | int(11)  | YES  |     | NULL    |       |
| testcol | int(11)  | YES  |     | NULL    |       |
+---------+----------+------+-----+---------+-------+
4 rows in set (0.00 sec)</code></pre>
<p>指定添加字段位置</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; alter table Atest add testcol2 int after id;
Query OK, 7 rows affected (0.02 sec)
Records: 7  Duplicates: 0  Warnings: 0

mysql&gt; describe Atest;
+----------+----------+------+-----+---------+-------+
| Field    | Type     | Null | Key | Default | Extra |
+----------+----------+------+-----+---------+-------+
| id       | char(30) | YES  |     | NULL    |       |
| testcol2 | int(11)  | YES  |     | NULL    |       |
| mname    | char(99) | NO   |     | NULL    |       |
| age      | int(11)  | YES  |     | NULL    |       |
| testcol  | int(11)  | YES  |     | NULL    |       |
+----------+----------+------+-----+---------+-------+
5 rows in set (0.00 sec)</code></pre></li>
<li><p>删除字段</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; alter table Atest drop mname;
Query OK, 7 rows affected (0.02 sec)
Records: 7  Duplicates: 0  Warnings: 0

mysql&gt; describe Atest;
+----------+----------+------+-----+---------+-------+
| Field    | Type     | Null | Key | Default | Extra |
+----------+----------+------+-----+---------+-------+
| id       | char(30) | YES  |     | NULL    |       |
| testcol2 | int(11)  | YES  |     | NULL    |       |
| age      | int(11)  | YES  |     | NULL    |       |
| testcol  | int(11)  | YES  |     | NULL    |       |
+----------+----------+------+-----+---------+-------+
4 rows in set (0.00 sec)</code></pre></li>
<li><p>修改表权限</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; grant all on web.* to liukairui@&#39;%&#39;;
#    授权 所有权限 在 数据库 数据表 给 用户 来自</code></pre>
<p>创建用户并授权</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; grant all on web.* to liukairui@&#39;%&#39; identified by &#39;123456&#39;;
#    授权 所有权限 在 数据库 数据表 给 用户 来自  密码</code></pre>
<p>取消授权</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; revoke all on web.* to liukairui@&#39;%&#39;;		# 注意to变成from</code></pre>
<ul>
<li><p>这里的web.*就是web数据库的所有表，可以写成数据库.表名 例如
web.Atest</p></li>
<li><p>授予权限all就是给了所有权限，可以改为用,隔开的select, insert,
update, delete</p></li>
<li><p>用什么授予的就要用什么收回，例如<code>*</code>授予的不能收回一个表，一个表授予的不能<code>*</code>收回</p></li>
</ul></li>
</ul>
<h3 id="数据库的备份和还原">数据库的备份和还原</h3>
<p><strong>mysqldump 备份</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysqldump -u 用户名 -p 数据库名 <span class="token operator">></span> /备份路径/备份文件名<span class="token punctuation">(</span>备份整个数据库<span class="token punctuation">)</span>
mysqldump -u 用户名 -p 数据库名 表名 <span class="token operator">></span> /备份路径/备份文件名<span class="token punctuation">(</span>备份数据表<span class="token punctuation">)</span>
	备份多个库:--databases 库 <span class="token number">1</span>,库 <span class="token number">2</span>
	备份所有库:--all-databases
	备份多个表:库名 表 <span class="token number">1</span> 表 <span class="token number">2</span>
还原:mysql 数据库 <span class="token operator">&lt;</span> 备份文件</code></pre>
<p><strong>mysqlhotcopy 备份</strong>:</p>
<p>支持工作时备份</p>
<p>备份：<code>mysqlhotcopy --flushlog -u=’用户’ -p=’密码’ --regexp=正则 备份目录</code></p>
<p>例如：<code>mysqlhotcopy --flushlog -u=’用户’ -p=’密码’ --regexp=^a</code>
备份a开头的数据库</p>
<p>还原:<code>cp -a 备份目录 数据目录</code>(/var/lib/mysql)</p>
<p>原理很简单，就是把/var/lib/mysql下的数据库复制了一份，但是提供了正则和刷新功能</p>
<p><strong>binlog日志备份</strong></p>
<p>binlog是一种只记录数据库状态修改操作(select, insert, update,
delete)的日志</p>
<p>当数据库损坏后我们可以制定一个时间段的日志，mysql会按照日志记录的操作内容操作数据库，恢复表，甚至是数据</p>
<p>要在配置文件中加入<code>log-bin=mysql-bin</code>，开启日志</p>
<p>恢复数据</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysqlbinlog--start-datetime ‘YY-MM-DD HH:MM:SS’ --stop-datetime ‘YY-MM-DD HH:MM:SS’ 二进制日志 <span class="token operator">|</span> mysql -uroot -p</code></pre>
<p>还可以使用<code>--start-position</code>，<code>--stop-position</code>按照大小恢复数据</p>
<h3 id="mysql主从备份">MySQL主从备份</h3>
<p>原理：主从两台计算机开启二进制日志，主机生成二进制日志后实时上传到从服务器，从服务器根据二进制日志完全复刻一个表出来，当主机<strong>故障</strong>后，从服务器可以保留有完整的数据库，但是，防故障，不防误操作，你删库之后从服务器也删库</p>
<ul>
<li><p>对主服务器操作</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash">log-bin<span class="token operator">=</span>mysql-bin			<span class="token comment"># 开启二进制日志</span>
<span class="token assign-left variable">server_id</span><span class="token operator">=</span><span class="token number">1</span>					<span class="token comment"># 设置服务器ID=1</span></code></pre></p>
<p>对从服务器操作</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">server_id</span><span class="token operator">=</span><span class="token number">2</span>					<span class="token comment"># 设置服务器ID=2</span></code></pre></p>
<p>注意
默认配置文件有一个server-id或者server_id，要把那行删除！</p></li>
<li><p>主服务器授权</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; grant replication slave on *.* to root@&#39;192.168.75.189&#39; [identified by &#39;123456&#39;];
#            这里不写all 是一个特殊权限		   位置              看你是不是创建用户</code></pre></li>
<li><p>主服务器查询当前状态</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; show master status;
+------------------+----------+--------------+------------------+
| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000018 |      107 |              |                  |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)</code></pre>
<p>看到当前二进制文件是000018，位置是107</p></li>
<li><p>在从服务器上进行配置</p>
<p>查看serverID</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; show variables like &#39;server_id&#39;;
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| server_id     | 2     |
+---------------+-------+
1 row in set (0.00 sec)</code></pre>
<p>修改master</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; CHANGE MASTER TO							# 主从备份
    -&gt; master_user&#x3D;&#39;root&#39;,						# 用户名
    -&gt; master_password&#x3D;&#39;123456&#39;,				# 密码
    -&gt; master_host&#x3D;&#39;192.168.75.175&#39;,	    	# 主服务器IP
    -&gt; master_log_file&#x3D;&#39;mysql-bin.000022&#39;,		# 二进制日志文件
    -&gt; master_log_pos&#x3D;107;						# 二进制日志位置
Query OK, 0 rows affected (0.02 sec)</code></pre>
<p>之后可以看到生成了<code>/usr/local/mysql/var/master.info</code></p>
<p>启动</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; start slave;</code></pre>
<p>查看启动成功</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; show slave status\G
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 192.168.193.175
                  Master_User: root
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: mysql-bin.000029
          Read_Master_Log_Pos: 107
               Relay_Log_File: C7B2-relay-bin.000002
                Relay_Log_Pos: 253
        Relay_Master_Log_File: mysql-bin.000029
             Slave_IO_Running: Yes			# 这两行两个yes就OK
            Slave_SQL_Running: Yes</code></pre>
<p>主服务器使用对应用户创建数据库，从服务器就可以看到,我们可以发现在主服务器修改的数据，从服务器看得到，从服务器写的数据主服务器看不到</p></li>
<li><p><strong>无法连接问题</strong></p>
<p>发现SQL线程Yes,但是IO线程还是connecting</p>
<p><pre class="language-mysql" data-language="mysql"><code class="language-mysql">mysql&gt; show slave status\G
*************************** 1. row ***************************
......
			 Slave_IO_Running: connecting
            Slave_SQL_Running: Yes</code></pre></p>
<p>查看MySQL的err日志，发现显示Error 2003 trying to connect master
user@xxx.xxx.xxx.xxx password=xxx...</p>
<p>确保已经做到如下几点</p>
<ul>
<li>关闭防火墙与SELinux</li>
<li>没有修改MySQL端口</li>
<li>在主服务器<code>netstat -antp</code>看到3306口在监听</li>
<li>从服务器上没有设置主机绑定</li>
<li>开启二进制日志</li>
<li>二进制日志文件与位置正确</li>
<li>用户密码正确</li>
</ul>
<p>尝试</p>
<ul>
<li><p>主机与物理机安装<code>telnet</code></p></li>
<li><p>主服务器安装telnet，尝试<code>telnet localhost 3306</code>，建立会话成功</p></li>
<li><p>物理机安装telnet，尝试<code>telnet 主机IP 3306</code>，建立会话失败</p></li>
<li><p>这个和防火墙有关，进行如下尝试</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">systemctl start firewalld			<span class="token comment"># 开启防火墙</span>
firewall-cmd --zone<span class="token operator">=</span>public --add-port<span class="token operator">=</span><span class="token number">3306</span>/tcp --permanent	<span class="token comment"># 开启3306</span>
firewall-cmd --reload				<span class="token comment"># 应用配置</span></code></pre></li>
<li><p>之后telnet与MySQL均连接成功</p></li>
</ul>
<p>原因</p>
<p>==为什么==</p></li>
</ul>
<h3 id="mysql主主备份">MySQL主主备份</h3>
<p>主从同步的原理就是主向从发送bin-log日志，从服务器通过bin-log构建主服务器的数据库，主从同步可以进行数据同步，还可以分摊主服务器的<strong>查询</strong>压力</p>
<p>主主备份可以进行<strong>写</strong>压力的分摊</p>
<p>在主从同步的基础上</p>
<p>在主从服务上进行配置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">replicate-do-db<span class="token operator">=</span>test					<span class="token comment"># 使用test进行数据同步</span>
binlog-ignore-db<span class="token operator">=</span>mysql					<span class="token comment"># 设置不同步的库</span>
binlog-ignore-db<span class="token operator">=</span>information_schema		<span class="token comment"># 设置不同步的库</span>
<span class="token comment"># 防止主键冲突，设置主键从1开始，每次+2,也就是1 3 5 7...</span>
auto-increment-increment<span class="token operator">=</span><span class="token number">2</span>				
auto-increment-offset<span class="token operator">=</span><span class="token number">1</span></code></pre>
<p>双向进行主从同步</p>
<h3 id="mysql一主多从">MySQL一主多从</h3>
<p>在主从的基础上，在给授权的时候多给一次，记得修改server_id</p>
<h3 id="mysql多主一从">MySQL多主一从</h3>
<p>原理是多个服务器连接到一个从服务器的MySQL，从服务器上开启多个MySQL进程，每个进程是一个独立分MySQL,多个主服务器对这个从服务器的不同数据库进行读写即可，在主从备份下需要重写从服务器的配置</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token punctuation">[</span>mysqld_multi<span class="token punctuation">]</span>
<span class="token assign-left variable">mysqld</span><span class="token operator">=</span>/usr/bin/mysqld_safe
<span class="token assign-left variable">mysqladmin</span><span class="token operator">=</span>/usr/bin/mysqladmin
<span class="token assign-left variable">log</span><span class="token operator">=</span>/tmp/multi.log

<span class="token punctuation">[</span>mysqld10<span class="token punctuation">]</span>					<span class="token comment"># 主服务器id=10的从服务器配置</span>
<span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token number">3306</span>					<span class="token comment"># 10的端口号</span>
<span class="token assign-left variable">datadir</span><span class="token operator">=</span>/var/lib/mysqlda/	<span class="token comment"># 设置保存位置</span>
pid-file<span class="token operator">=</span>/var/lib/mysqla/mysqld.pid		<span class="token comment"># 设置PID文件</span>
socket-file<span class="token operator">=</span>/var/lib/mysqla/mysqld.sock	<span class="token comment"># 设置Socket文件</span>
<span class="token assign-left variable">user</span><span class="token operator">=</span>mysql					<span class="token comment"># MySQL启动要运行在哪个用户上</span>
<span class="token assign-left variable">server_id</span><span class="token operator">=</span><span class="token number">1</span>					<span class="token comment"># 设置服务器ID= 1这个两个进程一样！</span>

<span class="token punctuation">[</span>mysqld20<span class="token punctuation">]</span>					<span class="token comment"># 主服务器id=20的从服务器配置</span>
<span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token number">3307</span>					<span class="token comment"># 20的端口号</span>
<span class="token assign-left variable">datadir</span><span class="token operator">=</span>/var/lib/mysqldb/	<span class="token comment"># 设置保存位置</span>
pid-file<span class="token operator">=</span>/var/lib/mysqlb/mysqld.pid		<span class="token comment"># 设置PID文件</span>
socket-file<span class="token operator">=</span>/var/lib/mysqlb/mysqld.sock	<span class="token comment"># 设置Socket文件</span>
<span class="token assign-left variable">user</span><span class="token operator">=</span>mysql					<span class="token comment"># MySQL启动要运行在哪个用户上</span>
<span class="token assign-left variable">server_id</span><span class="token operator">=</span><span class="token number">1</span>					<span class="token comment"># 设置服务器ID=1</span></code></pre>
<p>初始化从服务器</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysql_install_db --datadir<span class="token operator">=</span>/var/lib/mysqla --user<span class="token operator">=</span>mysql
mysql_install_db --datadir<span class="token operator">=</span>/var/lib/mysqlb --user<span class="token operator">=</span>mysql</code></pre>
<p>修改/var/lib/mysql{a,b}的所有者为mysql</p>
<p>启动从服务器<strong>线程</strong></p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysqld_multi --defaults-file<span class="token operator">=</span>/etc/my.cnf start <span class="token number">10</span>	<span class="token comment"># 开启10的从服务线程</span>
mysqld_multi --defaults-file<span class="token operator">=</span>/etc/my.cnf start <span class="token number">20</span>	<span class="token comment"># 开启20的从服务线程</span></code></pre>
<p>启动从服务器MySQL</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysql -P <span class="token number">3306</span> -S /var/lib/mysqla/mysql.sock
mysql -P <span class="token number">3307</span> -S /var/lib/mysqlb/mysql.sock</code></pre>
<p>从服务器分别获取授权</p>
<h3 id="mysql读写分离">MySQL读写分离</h3>
<p>在主从备份的基础上实现将所有写入的事件分配给主服务器，将所有查询的操作分配给从服务器，实现读写分离</p>
<p>原理：引入一个中间件，类似于Nginx的负载均衡，MySQL自带有MySQL
Proxy，很多企业都有基于此开发的中间件，我们采用Amoeba中间件</p>
<p>需要三台服务器：</p>
<ul>
<li>主服务器(192.168.193.175 MySQL 用户root 密码123456)</li>
<li>从服务器(192.168.193.189 MySQL 用户root 密码123456)</li>
<li>中间件Amoeba服务器(192.168.193.219 )</li>
</ul>
<p>==注意：在进行这个实验的时候，Amoeba服务器不得部署一键安装LNMP，这是因为Amoeba和TomCat使用端口冲突，我尝试关闭LNMP或者修改端口，都失败了，可能与LNMP一键脚本有关==</p>
<p><strong>实验步骤</strong></p>
<ul>
<li><p>下载amoeba <a
target="_blank" rel="noopener" href="https://pilotfiber.dl.sourceforge.net/project/amoeba/Amoeba%20for%20mysql/2.2.x/amoeba-mysql-binary-2.2.0.tar.gz">https://pilotfiber.dl.sourceforge.net/project/amoeba/Amoeba%20for%20mysql/2.2.x/amoeba-mysql-binary-2.2.0.tar.gz</a></p></li>
<li><p>修改三台服务器防火墙配置</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash">systemctl start firewalld			<span class="token comment"># 开启防火墙</span>
firewall-cmd --zone<span class="token operator">=</span>public --add-port<span class="token operator">=</span><span class="token number">3306</span>/tcp --permanent	<span class="token comment"># 开启3306</span>
firewall-cmd --reload				<span class="token comment"># 应用配置</span></code></pre></p></li>
<li><p>主从服务器完成主从备份配置</p></li>
<li><p>创建数据库dmeo,创建表demoA,插入三条数据</p></li>
<li><p>主从服务器用户授权(主从授权不一样)</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash">grant all on *.* to root@<span class="token string">'%'</span></code></pre></p></li>
<li><p>在Amoeba服务器下yum安装gcc*，Java，amoeba</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash">yum <span class="token function">install</span> gcc*
<span class="token function">mkdir</span> amoeba 											<span class="token comment"># 解压amoeba</span>
<span class="token function">tar</span> -xf amoeba-mysql-binary-2.2.0.tar.gz -C ./amoeba
<span class="token function">tar</span> -xvf jdk-8u281-linux-x64.tar.gz 
<span class="token function">mkdir</span> /amoeba
<span class="token function">cp</span> -r amoeba /usr/local/amoeba							<span class="token comment"># 复制amoeba</span>
<span class="token builtin class-name">cd</span> /usr/local/
<span class="token function">chmod</span> -R +x /usr/local/amoeba/bin/
<span class="token builtin class-name">cd</span>
<span class="token function">cp</span> -r jdk1.8.0_281/ /amoeba/jdk							<span class="token comment"># 安装jdk</span>
<span class="token function">vim</span> /etc/profile
    <span class="token comment"># 追加</span>
    <span class="token builtin class-name">export</span> <span class="token assign-left variable">JAVA_HOME</span><span class="token operator">=</span>/amoeba/jdk
    <span class="token builtin class-name">export</span> <span class="token assign-left variable"><span class="token environment constant">PATH</span></span><span class="token operator">=</span><span class="token variable">$JAVA_HOME</span>/bin:<span class="token environment constant">$PATH</span>
    <span class="token builtin class-name">export</span> <span class="token assign-left variable">CLASSPATH</span><span class="token operator">=</span>.:<span class="token variable">$JAVA_HOME</span>/bin/tools.jar:<span class="token variable">$JAVA_HOME</span>/lib/dt.jar:<span class="token variable">$CLASSPATH</span>
    <span class="token builtin class-name">export</span> <span class="token assign-left variable">AMOEBA_HOME</span><span class="token operator">=</span>/usr/local/amoeba
    <span class="token builtin class-name">export</span> <span class="token assign-left variable"><span class="token environment constant">PATH</span></span><span class="token operator">=</span><span class="token environment constant">$PATH</span><span class="token builtin class-name">:</span><span class="token variable">$AMOEBA_HOME</span>/bin
<span class="token builtin class-name">source</span> /etc/profile
/usr/local/amoeba/bin/amoeba 							<span class="token comment"># 看看有没有回显就可以</span>
java -version
<span class="token function">which</span> java												<span class="token comment"># 验证Java安装成功</span></code></pre></p></li>
<li><p>修改配置文件<code>/usr/local/amoeba/conf/amoeba.xml</code>这个文件主管的是用户和amoeba的连接与服务器池的定义</p>
<p><pre class="language-diff" data-language="diff"><code class="language-diff"># 修改server标签下的信息，这个标签是用来表示别人连接Ameoba的选项
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> &lt;property name="ipAddress">127.0.0.1&lt;/property>
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> &lt;property name="ipAddress">192.168.193.219&lt;/property>		# 修改绑定IP
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> &lt;property name="user">root&lt;/property>
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> &lt;property name="user">amoebauser&lt;/property>				# 修改amoeba用户，与系统用户不同
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> &lt;property name="password">&lt;/property>
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> &lt;property name="password">123456&lt;/property>				# 设置密码
</span></span># 修改一下几行 分别是 设置默认主服务器池 主服务器池 从服务器池
<span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> &lt;property name="defaultPool">server1&lt;/property>
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> &lt;property name="defaultPool">master&lt;/property>
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> &lt;!-- &lt;property name="writePool">server1&lt;/property> -->
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> &lt;property name="writePool">master&lt;/property>
</span></span><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> &lt;!-- &lt;property name="readPool">server1&lt;/property> -->
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> &lt;property name="readPool">slaves&lt;/property></span></span></code></pre></p></li>
<li><p>修改配置文件<code>/usr/local/amoeba/conf/dbServers.xml</code>这个文件主管的是amoeba和SQL服务器的连接</p>
<p><pre class="language-xml" data-language="xml"><code class="language-xml"><span class="token prolog">&lt;?xml version="1.0" encoding="gbk"?></span>

<span class="token doctype"><span class="token punctuation">&lt;!</span><span class="token doctype-tag">DOCTYPE</span> <span class="token name">amoeba:dbServers</span> <span class="token name">SYSTEM</span> <span class="token string">"dbserver.dtd"</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span><span class="token namespace">amoeba:</span>dbServers</span> <span class="token attr-name"><span class="token namespace">xmlns:</span>amoeba</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>http://amoeba.meidusa.com/<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
    <span class="token comment">&lt;!-- 这个是自带的不要动 --></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dbServer</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>abstractServer<span class="token punctuation">"</span></span> <span class="token attr-name">abstractive</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>factoryConfig</span> <span class="token attr-name">class</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>com.meidusa.amoeba.mysql.net.MysqlServerConnectionFactory<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>manager<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>$&#123;defaultManager&#125;<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>sendBufferSize<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>64<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>receiveBufferSize<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>128<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>

            <span class="token comment">&lt;!-- mysql port --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>port<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>3306<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>

            <span class="token comment">&lt;!-- mysql schema --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>schema<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>test<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>

            <span class="token comment">&lt;!-- mysql user --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>user<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>

            <span class="token comment">&lt;!--  mysql password
            &lt;property name="password">password&lt;/property>
            --></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>factoryConfig</span><span class="token punctuation">></span></span>

        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>poolConfig</span> <span class="token attr-name">class</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>com.meidusa.amoeba.net.poolable.PoolableObjectPool<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>maxActive<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>500<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>maxIdle<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>500<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>minIdle<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>10<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>minEvictableIdleTimeMillis<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>600000<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>timeBetweenEvictionRunsMillis<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>600000<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>testOnBorrow<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>true<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>testOnReturn<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>true<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>testWhileIdle<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>true<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>poolConfig</span><span class="token punctuation">></span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dbServer</span><span class="token punctuation">></span></span>
    <span class="token comment">&lt;!-- 从这里开始配置主服务器 master就是刚刚指定的 --></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dbServer</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>master<span class="token punctuation">"</span></span>  <span class="token attr-name">parent</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>abstractServer<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>factoryConfig</span><span class="token punctuation">></span></span>
            <span class="token comment">&lt;!-- IP 端口 数据库 用户 密码 --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>ipAddress<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>192.168.193.175<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>port<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>3306<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>schema<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>demo<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>user<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>password<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>123456<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>factoryConfig</span><span class="token punctuation">></span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dbServer</span><span class="token punctuation">></span></span>

    <span class="token comment">&lt;!-- 从这里开始配置从服务器 我们给他一个名字slave1 --></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dbServer</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>slave1<span class="token punctuation">"</span></span>  <span class="token attr-name">parent</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>abstractServer<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>factoryConfig</span><span class="token punctuation">></span></span>
            <span class="token comment">&lt;!-- mysql ip --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>port<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>3306<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>schema<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>demo<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>user<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>password<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>123456<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>ipAddress<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>192.168.193.189<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>factoryConfig</span><span class="token punctuation">></span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dbServer</span><span class="token punctuation">></span></span>

    <span class="token comment">&lt;!-- 这里创建从服务器池 名字是刚才指定的 是一个虚拟的机器组合 --></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dbServer</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>slaves<span class="token punctuation">"</span></span> <span class="token attr-name">virtual</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>poolConfig</span> <span class="token attr-name">class</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>com.meidusa.amoeba.server.MultipleServerPool<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
            <span class="token comment">&lt;!-- 轮询方式 --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>loadbalance<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
            <span class="token comment">&lt;!-- 从服务器池 slave1,slave2... --></span>
            <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>poolNames<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>slave1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>property</span><span class="token punctuation">></span></span>
        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>poolConfig</span><span class="token punctuation">></span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dbServer</span><span class="token punctuation">></span></span>

<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span><span class="token namespace">amoeba:</span>dbServers</span><span class="token punctuation">></span></span></code></pre></p></li>
<li><p>修改启动脚本配置
加大空间，修改amoeba/bin/amoeba文件，修改为256k即可</p>
<p><pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token assign-left variable">DEFAULT_OPTS</span><span class="token operator">=</span><span class="token string">"-server -Xms256m -Xmx256m -Xss256k"</span></code></pre></p></li>
<li><p>启动</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">/usr/local/amoeba/bin/amoeba start</code></pre>
<p>看到说他守护在8066就OK了</p></li>
</ul>
<p><strong>结果验证</strong></p>
<ul>
<li><p>物理机登陆到Amoeba(使用Amoeba用户名)</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">mysql -uamoebauser -p123456 -h192.168.90.84 -P8066 </code></pre></li>
<li><p>物理机查看数据库</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">show databases</code></pre>
<p>可以看到全部数据库</p></li>
<li><p>物理机创建数据，查看数据</p>
<pre class="language-mysql" data-language="mysql"><code class="language-mysql">use demo
insert into demoA values(111,&quot;AA&quot;,&quot;AA&quot;);</code></pre></li>
<li><p>在从服务器上登陆MySQL，关闭主从</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">stop slave<span class="token punctuation">;</span></code></pre></li>
<li><p>物理机正常访问数据，写入数据，但是写入的数据不会显示在数据表中</p></li>
<li><p>关闭从服务器，正常写入数据，查询数据失败</p></li>
<li><p>开启从服务器，开启主从同步</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">start slave<span class="token punctuation">;</span></code></pre>
<p>刚刚没有查询到的数据全部同步，主从同步正常</p></li>
</ul>
<h2 id="非关系型数据库平台redis">非关系型数据库平台(Redis)</h2>
<p>随着Web2.0的兴起，传统的关系型数据库有很大的问题，多样的非关系型数据库可以解决性能瓶颈的问题</p>
<p>Redis是一个键值对模型的数据库，支持字符串，哈希，链表，集合，有序集合，其部署服务器也叫做数据结构服务器，这些数据结构都支持交并补差的操作，目前Redis主要用于配合Mysql实现高效的数据检索(例如京东的商品筛选)</p>
<p>Redis 和 Memcached 类似，它支持存储的 value 类型相对更多，与
memcached 一样，为了保证效 率，数据都是缓存在内存中，区别是 Redis
会周期性的把更新的数据写入磁盘或者把修改操作写入追
加的记录文件，并且在此基础上实现了 master-slave(主从)同步。</p>
<h3 id="在centos7下安装redis">在CentOS7下安装Redis</h3>
<p>去<a target="_blank" rel="noopener" href="https://redis.io/">官网</a>下载最新源码包</p>
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token comment"># 升级gcc cmake</span>
gcc -v
yum <span class="token function">install</span> centos-release-scl
yum <span class="token function">install</span> devtoolset-9-gcc* cmake3 cmake tcl
scl <span class="token builtin class-name">enable</span> devtoolset-9 <span class="token function">bash</span>
<span class="token function">which</span> gcc
<span class="token builtin class-name">export</span> <span class="token assign-left variable">CC</span><span class="token operator">=</span>/opt/rh/devtoolset-9/root/usr/bin/gcc
<span class="token builtin class-name">export</span> <span class="token assign-left variable">CXX</span><span class="token operator">=</span>/opt/rh/devtoolset-9/root/usr/bin/g++
<span class="token comment"># make</span>
<span class="token function">tar</span> -xf redis-6.2.1.tar.gz 
<span class="token builtin class-name">cd</span> redis-6.2.1/
<span class="token function">make</span>
<span class="token function">make</span> <span class="token function">install</span> <span class="token assign-left variable">PREFIX</span><span class="token operator">=</span>/usr/local/redis
<span class="token comment"># 请注意 正确安装的输出就这么少</span>
<span class="token builtin class-name">cd</span> src <span class="token operator">&amp;&amp;</span> <span class="token function">make</span> <span class="token function">install</span>
make<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span>: 进入目录“/root/redis-6.2.1/src”
Hint: It<span class="token string">'s a good idea to run '</span><span class="token function">make</span> test' <span class="token punctuation">;</span><span class="token punctuation">)</span>
    INSTALL <span class="token function">install</span>
    INSTALL <span class="token function">install</span>
    INSTALL <span class="token function">install</span>
make<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span>: 离开目录“/root/redis-6.2.1/src”

<span class="token function">mkdir</span> /usr/local/redis/etc
<span class="token function">cp</span> ./redis.conf /usr/local/redis/etc/			<span class="token comment"># 复制配置文件方便操作</span></code></pre>
<p>配置允许后台启动：/usr/local/redis/etc/redis.conf</p>
<pre class="language-diff" data-language="diff"><code class="language-diff"><span class="token deleted-sign deleted"><span class="token prefix deleted">-</span><span class="token line"> daemonize no
</span></span><span class="token inserted-sign inserted"><span class="token prefix inserted">+</span><span class="token line"> daemonize yes</span></span></code></pre>
<p>启动服务 必须加配置文件</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">/usr/local/redis/bin/redis-server /usr/local/redis/etc/redis.conf</code></pre>
<p>连接测试</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">redis-cli			<span class="token comment"># 使用客户端链接 ctrl+D退出 </span>
	<span class="token comment"># -h IP:			# 连接指定的 redis 服务器</span>
	<span class="token comment"># -p 6379:  		# 指定 redis 服务器的端口</span>
	<span class="token comment"># -a 				# 密码:使用密码登录</span>
	<span class="token comment"># -n 				# 数据库号: 指定连接哪个数据库</span>
	<span class="token comment"># --raw		    	# redis 支持存储中文</span>

<span class="token function">pkill</span> -9 redis		<span class="token comment"># 关闭客户端</span>
redis-cli <span class="token function">shutdown</span>  <span class="token comment"># 或者这样关闭客户端</span></code></pre>
<h3 id="数据类型">数据类型</h3>
<ul>
<li><p>string 类型及操作 string 是最简单的类型,一个 key 对应一个
value,string 类型是二进制安全的。redis 的 string 可以包含任何数据。</p>
<ul>
<li><p>set:设置 key 对应的值为 string 类型 <pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>set name lkr</code></pre></p></li>
<li><p>setnx:设置 key 对应的值为 string 类型,如果 key 已经存在,返回 0,nx
是 not exist 的意思</p></li>
<li><p>get:获取 key 对应的 string 值,如果 key 不存在返回 nil</p></li>
<li><p>mset &amp; mget 同时设置和获取多个键值对</p></li>
<li><p>incrby:对 key 的值做加加(指定值)操作,并返回新的值</p></li>
<li><p>del:删除一个已创建的 key</p></li>
</ul></li>
<li><p>hash 类型及操作 Redis hash 是一个 string 类型的 field(字段)和
value 的映射表,它的添加、删除操作都是 0(1)平均;hash
特别适合用于存储对象,相较于将对象的每个字段存成单个 string
类型,将一个对象存储在 hash
类型中会占用更少的内存,并且可以更方便的存取整个对象。</p>
<ul>
<li>hset:设置 hash field 为指定值,如果 key 不存在,则先创建。 例如:为
num1 表创建一个叫 name 字段(key),键值是 liuchuan <pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>hset num1 name liuchuan</code></pre></li>
<li>hget、hmset、hmget 意义同上近似</li>
<li>hdel:删除制定表中的某一个键值对</li>
<li>hgetall:列出表中的所有键值对</li>
</ul></li>
<li><p>list 类型及操作</p>
<ul>
<li><p>list 是一个链表结构,主要功能是
push、pop、获取一个范围内的所有值等等,操作中 key 理解为链表的名字。Redis
的 list 类型其实就是一个每个子元素都是 string
类型的双向链表。我们可以通过push、pop
操作从链表的头部或尾部添加删除元素。</p></li>
<li><p>lpush:在 key 对应 list 的头部添加字符串元素。</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>lpush zhangsan zhangsan
redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>lpush zhangsan <span class="token number">18</span></code></pre></li>
<li><p>lrange:从指定链表中获取指定范围的元素</p>
<pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>lrange zhangsan <span class="token number">0</span> -1</code></pre>
<p>0 -1:此范围代表全部元素,意为从头到尾</p></li>
<li><p>lpush、rpush、lpop、rpop、lrange</p></li>
</ul></li>
<li><p>Set 类型及操作 set 是集合,他是 string 类型的无序集合。Set 是通过
hash table 实现的,对集
、交集、差集。通过这些操作我们可以实现社交网站中的好友推荐和 blog 的 tag
功能。集合不允许有重复值。</p>
<ul>
<li><p>sadd:添加一个或多个元素到集合中 <pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>sadd mset <span class="token number">1</span> <span class="token number">2</span> <span class="token number">3</span> <span class="token number">4</span></code></pre></p></li>
<li><p>smembers:获取集合里面所有的元素 <pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span> smembers mset		</code></pre></p></li>
<li><p>srem:从集合中删除指定的一个或多个元素</p></li>
<li><p>spop:随机从集合中删除一个元素,并返回</p></li>
<li><p>scard:获取集合里面的元素个数</p></li>
<li><p>sdiff:返回集合 1 与集合 2 的差集。以集合 1 为主
<pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>sdiff mset1 mset2		</code></pre></p></li>
<li><p>sinter:获得两个集合的交集</p></li>
<li><p>sunion:获得指定集合的并集</p></li>
</ul></li>
<li><p>zset 类型及操作 zset 是 set 的一个升级版本,它在
set的基础上增加了一个顺序属性,这一属性在添加修改元素的时候可以指定,每次指定后,zset
会自动重新按新的值调整顺序。可以理解为有两列的 mysql 表,一列存的
value,一列存的顺序。操作中 key 理解为 zset 的名字。</p>
<ul>
<li>zadd:向一个指定的有序集合中添加元素,每一个元素会对应的有一个分数。你可以指定多个分数/成员组合。如果一个指定的成员已经在对应的有序集合中了,那么其分数就会被更新成最新的,并且该成员会重新调整到正确的位置,以确保集合有序。分数的值必须是一个表示数字的字符串。
<pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>zadd zset <span class="token number">2</span> zhangsan <span class="token number">1</span> lisi <span class="token number">1</span> wangwu</code></pre></li>
<li>zrange:返回有序集合中,指定区间内的成员。其中成员按照
score(分数)值从小到大排序。具有相同 score 值的成员按照字典顺序来排列。
<pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>zrange zset <span class="token number">0</span> -1 withscores	</code></pre> 注: withscores
返回集合中元素的同时,返回其分数(score)</li>
<li>zrem:删除有序集合中指定的值 <pre class="language-bash" data-language="bash"><code class="language-bash">redis127.0.0.1:637<span class="token operator"><span class="token file-descriptor important">9</span>></span>zrem zset zhangsan</code></pre></li>
<li>zcard:返回有序集合元素的个数</li>
</ul></li>
</ul>
<h3 id="其他相关命令">其他相关命令</h3>
<ul>
<li>keys:按照键名查找指定的键。支持通配符(* ?等)
redis127.0.0.1:6379&gt;keys h*llo</li>
<li>exists:确认一个键是否存在(1 表示存在)</li>
<li>del:删除一个键(通用)</li>
<li>expire:设置一个键(已存在)的过期时间,如果键已经过期,将会被自动删除</li>
<li>ttl:以秒为单位,返回指定键的剩余有效时间 当 key 不存在时,返回 -2 。
当 key 存在但没有设置剩余生存时间时,返回 -1 。 否则,以秒为单位,返回 key
的剩余生存时间。</li>
<li>select:选择一个数据库,默认连接的数据库是 0,可以支持共 16
个数据库。在配置文件中,通过 databases 16 关键字定义。</li>
<li>move:将当前数据库的键移动到指定的数据库中</li>
<li>type:返回键的类型</li>
<li>dbsize:返回当前库中键的数量(所有类型)</li>
<li>save:保存所有的数据。很少在生产环境直接使用 SAVE
命令,因为它会阻塞所有的客户端的请求,可以使用 BGSAVE 命令代替. 如果在
BGSAVE 命令的保存数据的子进程发生错误的时,用
SAVE命令保存最新的数据是最后的手段。</li>
<li>info:获取服务器的详细信息</li>
<li>config get:获取 redis 服务器配置文件中的参数。支持通配符</li>
<li>flushdb:删除当前数据库中所有的数据</li>
<li>flushall:删除所有数据库中的所有数据</li>
</ul>
<h3 id="redis-高级应用">Redis 高级应用</h3>
<p><strong>密码防护</strong>：给 redis 服务器设置密码 -
修改配置文件/usr/local/redis/etc/redis.conf <pre class="language-bash" data-language="bash"><code class="language-bash">requirepass <span class="token number">123456</span></code></pre> - 重启 redis
<pre class="language-bash" data-language="bash"><code class="language-bash"><span class="token function">pkill</span> redis
<span class="token punctuation">..</span>/bin/redis-server <span class="token punctuation">..</span>./etc/redis.conf</code></pre> - 客户端登录 <pre class="language-none"><code class="language-none">..&#x2F;bin&#x2F;redis-cli -a 123456</code></pre> <strong>主从同步</strong> -
Redis 主从复制过程: - Slave 与 master 建立连接,发送 sync 同步命令 -
Master 会启动一个后台进程,将数据库快照保存到文件中,同时 master
主进程会开始收集新的写命令并缓存。 - 后台完成保存后,就将此文件发送给
slave - Slave 将此文件保存到硬盘上 -
主服务器给自己设置好密码即可(iptables&amp;SELinux 关闭) - 主:找到 bind
127.0.0.1 注释掉,或者修改为本机的 IP 地址(重启) - 从: <pre class="language-bash" data-language="bash"><code class="language-bash">replicaof <span class="token operator">&lt;</span>masterip<span class="token operator">></span> <span class="token operator">&lt;</span>msterport<span class="token operator">></span>
masterauth <span class="token operator">&lt;</span>masterpass<span class="token operator">></span></code></pre> -
重启从服务器,然后测试(可通过 info 命令获取当前服务器身份类型)</p>
<p><strong>数据持久化</strong> Redis
是一个支持持久化的内存数据库,也就是说需要经常将内存中的数据同步到硬盘来保证持久化。
- snapshotting(快照)--默认方式RDB
持久化方式能够在指定的时间间隔能对你的数据进行快照存储。是默认的持久化方式。这种方式是将内存中数据以快照的方式写入到二进制文件中,默认的文件名为
dump.rdb。这种持久化方式被称为快照 snapshotting(快照)。 - 过了 900
秒并且有 1 个 key 发生了改变 就会触发 save 动作 - 过了 300 秒并且有 10
个 key 发生了改变 就会触发 save 动作 - 过了 60 秒并且至少有 10000 个 key
发生了改变 也会触发 save 动作 结论:在 redis.conf 文件中 dir
./定义了数据库文件的存放位置,默认是当前目录。所以每次重启
redis服务所在的位置不同,将会生成新的 dump.rdb
文件;建议服务器搭建完成时先修改快照文件保存位置。</p>
<ul>
<li>append-only file(缩写 aof)使用 AOF 会让你的 Redis 更加耐久:
你可以使用不同的持久化策略:每次写的时候备份、每秒备份、无备份。使用默认的每秒备份策略,Redis
的性能依然很好(备份是由后台线程进行处理的,主线程会尽力处理客户端请求),一旦出现故障,你最多丢失
1 秒的数据。 打开 redis.conf 配置文件开启 AOF 持久化 <pre class="language-bash" data-language="bash"><code class="language-bash">appendonly no
<span class="token comment"># 默认不使用 AOF 持久化(450 行)将 no 改成 yes。</span>
appendfsync always
<span class="token comment"># 有写操作,就马上写入磁盘。效率最慢,但是最安全</span>
appendfsync everysec
<span class="token comment"># 默认,每秒钟写入磁盘一次。</span>
appendfsync no
<span class="token comment"># 不进行 AOF 备份,将数据交给操作系统处理。最快,最不安全</span></code></pre>
测试:重启 redis 服务,登录 client 添加一个键值,退出然后 ls
命令查看下是否生成 appendonly.aof。可以用 cat 查看。</li>
</ul>
<hr />
<p><strong>完结撒花</strong></p>

    </div>

    
    
    
      


    <footer class="post-footer">
          <div class="reward-container">
  <div></div>
  <button>
    赞赏
  </button>
  <div class="post-reward">
      <div>
        <img src="/images/wechatpay.png" alt="Liu Kairui 微信">
        <span>微信</span>
      </div>
      <div>
        <img src="/images/alipay.png" alt="Liu Kairui 支付宝">
        <span>支付宝</span>
      </div>

  </div>
</div>

          

<div class="post-copyright">
<ul>
  <li class="post-copyright-author">
      <strong>本文作者： </strong>Liu Kairui
  </li>
  <li class="post-copyright-link">
      <strong>本文链接：</strong>
      <a href="http://liukairui.me/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/" title="Linux网络服务与数据库笔记">http://liukairui.me/article/Linux网络服务与数据库笔记/</a>
  </li>
  <li class="post-copyright-license">
    <strong>版权声明： </strong>本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/deed.zh" rel="noopener" target="_blank"><i class="fab fa-fw fa-creative-commons"></i>BY-NC-SA</a> 许可协议。转载请注明出处！
  </li>
</ul>
</div>

          <div class="post-tags">
              <a href="/tags/%E8%BF%90%E7%BB%B4/" rel="tag"><i class="fa fa-tag"></i> 运维</a>
              <a href="/tags/Linux/" rel="tag"><i class="fa fa-tag"></i> Linux</a>
          </div>

        

          <div class="post-nav">
            <div class="post-nav-item">
                <a href="/article/Linux%E7%B3%BB%E7%BB%9F%E7%AE%A1%E7%90%86%E6%95%99%E7%A8%8B%E7%AC%94%E8%AE%B0/" rel="prev" title="Linux系统管理教程笔记">
                  <i class="fa fa-chevron-left"></i> Linux系统管理教程笔记
                </a>
            </div>
            <div class="post-nav-item">
                <a href="/article/Node.js%E8%B5%B7%E6%AD%A5%E7%AC%94%E8%AE%B0/" rel="next" title="Node.js起步笔记">
                  Node.js起步笔记 <i class="fa fa-chevron-right"></i>
                </a>
            </div>
          </div>
    </footer>
  </article>
</div>






    <div class="comments" id="valine-comments"></div>
</div>
  </main>

  <footer class="footer">
    <div class="footer-inner">


<div class="copyright">
  &copy; 2019 – 
  <span itemprop="copyrightYear">2022</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Liu Kairui</span>
</div>
<div class="busuanzi-count">
    <span class="post-meta-item" id="busuanzi_container_site_uv">
      <span class="post-meta-item-icon">
        <i class="fa fa-user"></i>
      </span>
      <span class="site-uv" title="总访客量">
        <span id="busuanzi_value_site_uv"></span>
      </span>
    </span>
    <span class="post-meta-item" id="busuanzi_container_site_pv">
      <span class="post-meta-item-icon">
        <i class="fa fa-eye"></i>
      </span>
      <span class="site-pv" title="总访问量">
        <span id="busuanzi_value_site_pv"></span>
      </span>
    </span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" rel="noopener" target="_blank">Hexo</a> & <a href="https://theme-next.js.org/muse/" rel="noopener" target="_blank">NexT.Muse</a> 强力驱动
  </div>
  <div class="addthis_inline_share_toolbox">
    <script src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-6231eb6f709fc868" async="async"></script>
  </div><script
  async
  src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"
></script>

 
<script src="https://cdn.jsdelivr.net/npm/moment@2.22.2/moment.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/moment-precise-range-plugin@1.3.0/moment-precise-range.min.js"></script>
<script>
  function timer() {
    var ages = moment.preciseDiff(moment(),moment(20201101,"YYYYMMDD"));
    ages = ages.replace(/years?/, "年");
    ages = ages.replace(/months?/, "月");
    ages = ages.replace(/days?/, "天");
    ages = ages.replace(/hours?/, "小时");
    ages = ages.replace(/minutes?/, "分");
    ages = ages.replace(/seconds?/, "秒");
    ages = ages.replace(/\d+/g, '<span class="daysCnt" style="color:#1890ff">$&</span>');
    div.innerHTML = `我已在此等候你 ${ages}`;
    div.className="workDays";
  }
  var div = document.createElement("div");
  //插入到copyright之后
  var copyright = document.querySelector(".copyright");
  document.querySelector(".footer-inner").insertBefore(div, copyright.nextSibling);
  timer();
  setInterval("timer()",1000)
</script>



    </div>
  </footer>

  
  <script src="https://cdnjs.cloudflare.com/ajax/libs/animejs/3.2.1/anime.min.js"></script>
  <script src="https://cdn.jsdelivr.net/npm/@next-theme/pjax@0.5.0/pjax.min.js" integrity="sha256-3NkoLDrmHLTYj7csHIZSr0MHAFTXth7Ua/DDt4MRUAg=" crossorigin="anonymous"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/jquery.fancybox.min.js" integrity="sha256-yt2kYMy0w8AbtF89WXb2P1rfjcP/HTHLT7097U8Y5b8=" crossorigin="anonymous"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/lozad.js/1.16.0/lozad.min.js"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/pangu/4.0.7/pangu.min.js"></script>
<script src="/js/comments.js"></script><script src="/js/utils.js"></script><script src="/js/motion.js"></script><script src="/js/schemes/muse.js"></script><script src="/js/next-boot.js"></script><script src="/js/pjax.js"></script>

  
<script src="https://cdn.jsdelivr.net/npm/hexo-generator-searchdb@1.4.0/dist/search.js" integrity="sha256-vXZMYLEqsROAXkEw93GGIvaB2ab+QW6w3+1ahD9nXXA=" crossorigin="anonymous"></script>
<script src="/js/third-party/search/local-search.js"></script>


  <script class="next-config" data-name="mermaid" type="application/json">{"enable":true,"theme":"forest","js":{"url":"https://cdnjs.cloudflare.com/ajax/libs/mermaid/8.14.0/mermaid.min.js","integrity":"sha256-7wT34TI0pEBeEFoi4z+vhuSddGh6vUTMWdqJ2SDe2jg="}}</script>
  <script src="/js/third-party/tags/mermaid.js"></script>

  <script src="/js/third-party/fancybox.js"></script>

  <script src="/js/third-party/pace.js"></script>

  
  <script data-pjax async src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>


  <script class="next-config" data-name="leancloud_visitors" type="application/json">{"enable":true,"app_id":"ABKlVtS4cyaWYEwunPyK3sXt-9Nh9j0Va","app_key":"xxGXdTTEGEVifs2TLB35844I","server_url":"https://abklvts4.lc-cn-e1-shared.com","security":false}</script>
  <script src="/js/third-party/statistics/lean-analytics.js"></script>


  

  <script class="next-config" data-name="enableMath" type="application/json">true</script><script class="next-config" data-name="mathjax" type="application/json">{"enable":true,"tags":"none","mhchem":true,"js":{"url":"https://cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.0/es5/tex-mml-chtml.min.js"}}</script>
<script src="/js/third-party/math/mathjax.js"></script>


  <script src="https://cdnjs.cloudflare.com/ajax/libs/quicklink/2.2.0/quicklink.umd.js" integrity="sha256-4kQf9z5ntdQrzsBC3YSHnEz02Z9C1UeW/E9OgnvlzSY=" crossorigin="anonymous"></script>
  <script class="next-config" data-name="quicklink" type="application/json">{"enable":true,"home":false,"archive":false,"delay":true,"timeout":3000,"priority":true,"url":"http://liukairui.me/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/"}</script>
  <script src="/js/third-party/quicklink.js"></script>
<script src="https://cdn.jsdelivr.net/npm/darkmode-js@1.5.7/lib/darkmode-js.min.js"></script>

<script>
var options = {
  bottom: '64px',
  right: 'unset',
  left: '32px',
  time: '0.5s',
  mixColor: 'transparent',
  backgroundColor: 'transparent',
  buttonColorDark: '#100f2c',
  buttonColorLight: '#fff',
  saveInCookies: true,
  label: '🌓',
  autoMatchOsTheme: true
}
const darkmode = new Darkmode(options);
window.darkmode = darkmode;
darkmode.showWidget();
</script>


<script class="next-config" data-name="valine" type="application/json">{"enable":true,"appId":"ABKlVtS4cyaWYEwunPyK3sXt-9Nh9j0Va","appKey":"xxGXdTTEGEVifs2TLB35844I","serverURLs":"https://abklvts4.lc-cn-e1-shared.com","placeholder":"请开始你的表演","avatar":"identicon","meta":["nick","mail","link"],"pageSize":10,"lang":"zh-CN","visitor":false,"comment_count":true,"recordIP":true,"enableQQ":true,"requiredFields":[],"el":"#valine-comments","path":"/article/Linux%E7%BD%91%E7%BB%9C%E6%9C%8D%E5%8A%A1%E4%B8%8E%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AC%94%E8%AE%B0/"}</script>
<script>
document.addEventListener('page:loaded', () => {
  NexT.utils.loadComments(CONFIG.valine.el)
    .then(() => NexT.utils.getScript(
      'https://cdn.jsdelivr.net/npm/valine@1.4.14/dist/Valine.min.js',
      { condition: window.Valine }
    ))
    .then(() => {
      new Valine(CONFIG.valine);
    });
});
</script>


  <script async src="/js/fireworks.js"></script>




  <script src="/js/activate-power-mode.min.js"></script>
  <script>
    POWERMODE.colorful = true;
    POWERMODE.shake = false;
    document.body.addEventListener('input', POWERMODE);
  </script>




  <script src="/js/wobblewindow.js"></script>
  <script>
    //只在桌面版网页启用特效 记得同步到header.njk
    if( window.innerWidth > 768  ){
      $(document).ready(function () {
        
          $('body>main>header').wobbleWindow({
            radius: 50,
            movementTop: false,
            movementLeft: false,
            movementRight: false,
            debug: false,
          });
        

        //
        //  $('body header>aside').wobbleWindow({
        //    radius: 50,
        //    movementLeft: false,
        //    movementTop: false,
        //    movementBottom: false,
        //    position: 'fixed',
        //    debug: false,
        //  });
        //

        
          $('body>footer').wobbleWindow({
            radius: 50,
            movementBottom: false,
            movementLeft: false,
            movementRight: false,
            debug: false,
          });
        
      });
    }
  </script>


 
<script>
  $(document).ready(function(){
    var beian = document.querySelector(".footer-inner > .beian > a");
    var cpr=document.querySelector(".footer-inner > .copyright");
    var cnz=document.querySelector(".workDays");//.parentNode;
    var bsz=document.querySelector(".busuanzi-count");
    if(cnz!=null&&bsz!=null)
      cnz.parentNode.insertBefore(bsz,cnz);
    if(bsz == null || bsz == undefined || document.querySelector("#busuanzi_value_site_pv").innerText=="" || document.querySelector("#busuanzi_value_site_uv").innerText == "")
      bsz.remove();
    checkIndex();
    if(beian){cpr.classList.add('split-line');cpr.appendChild(beian);}
  })
  $(document).on('pjax:complete',checkIndex);
</script>



<script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"log":false,"model":{"jsonPath":"/live2dw/assets/hijiki.model.json"},"display":{"position":"right","width":150,"height":300},"mobile":{"show":false},"react":{"opacity":0.7}});</script></body>
</html>
